Keep the provisioner client's needs grant for one release, removed after the lease write, so the client before V3 still writes its needs while its delivery reaches each node (issue 1954)

go/buscompose/buscompose_test.go

@@ -657,7 +657,9 @@ func healthChecks(t *testing.T) {
 		"a.mesh-hand-acts": {"$KV.mesh-hand-acts_warrants.mesh-config.ask-1", "mesh.log.mesh-hand-acts.acts.act-1"},
 		"a.disk-load":      {"$KV.disk-load_readings.a.pg.data"},
 		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak",
-			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.a.keycloak"},
+			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.a.keycloak",
+			// The needs, for the client before V3, until the lease write (review round 3).
+			"$KV." + ProvisionerNeedsBucket + ".a.keycloak.db.x"},
 		// ADR 0571 clause 3: restic's bundle writes each item's last good night as its own state; the self-check reads it.
 		"a.mesh-self-check": {"$JS.API.DIRECT.GET.KV_restic_good.$KV.restic_good.a.pg.data"},
 		"a.mesh-grants":     {"$KV.mesh-grants_withheld.reader.mail.a"},
@@ -690,10 +692,10 @@ func healthChecks(t *testing.T) {
 		// Each writes its own state alone, and these users are composed.
 		"a.disk-load":             {"$KV.restic_good.a.pg.data"},
 		"a.mesh-delivery-builder": {"$KV.disk-load_readings.a.pg.data"},
-		// Another machine's plans are not its to read; no client writes or reads the needs any more.
+		// Another machine's plans are not its to read, nor another machine's needs, which it keeps for the client before
+		// V3 until the lease write.
 		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.b.keycloak",
-			"$KV.mesh-provisioner_plans.a.keycloak", "$KV." + ProvisionerNeedsBucket + ".a.keycloak.db.x",
-			"$JS.API.DIRECT.GET.KV_" + ProvisionerNeedsBucket + ".$KV." + ProvisionerNeedsBucket + ".a.keycloak.db.x"},
+			"$KV.mesh-provisioner_plans.a.keycloak", "$KV." + ProvisionerNeedsBucket + ".b.keycloak.db.x"},
 		// Only the assigner writes seat-holders.
 		"a.artifact-store-tools": {"$KV.mesh-delivery-assigner_seat-holders.mesh-broker"},
 		// Only disk-load writes its readings.

go/buscompose/provisioner.go

@@ -71,10 +71,14 @@ var (
 )
 
 // ProvisionerWrites are the server's buckets a client writes, and reads, its own machine's keys of (`<node>.>`)
-// and no other's: what it applied, and the items of the collections on its machine. A client cannot say another
-// machine applied a file. It records no needs: since the client reads its machine's plans from the seat
-// mesh-provisioner's `plans` (novox/hq ADR 0570 clause 2; the client's V3), the needs bucket is granted to none.
-var ProvisionerWrites = []string{ProvisionerAppliedBucket, ProvisionerCollectBucket}
+// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A client
+// cannot write another machine's needs, or say another machine applied a file.
+//
+// **The needs stay granted for one release, and are removed after the lease write** (review round 3 of design 47's
+// release): the client's V3 reads its machine's plans from the seat mesh-provisioner's `plans` (novox/hq ADR 0570 clause
+// 2) and records no needs, but the client before it still runs on a node until its delivery reaches it, and it writes
+// them.
+var ProvisionerWrites = []string{ProvisionerNeedsBucket, ProvisionerAppliedBucket, ProvisionerCollectBucket}
 
 // VerbsTheProvisionerAsksTheVault are the vault's verbs a provisioner client asks in its own name (ADR 0349
 // clause 11): `get`, a secret its machine's declaration names, answered sealed to the asker's key. On the subject