Place a given secret-family member whose value the Input lacks with a stand-in and name it foreseen, not drop it (review round 1, finding 4). The test failed first; the suite is 1256 tests in 1.05 s

go/compose/credentials.go

@@ -315,6 +315,11 @@ func (c *composer) ownSecretsFor(node Node, plan catalogue.Resolution, handing c
 					needed[m.Module] = map[string]string{}
 				}
 				needed[m.Module][g.Name] = g.Sealed
+				if g.Sealed == "" {
+					// Given, and its value is not in the Input: placed with a stand-in, named.
+					needed[m.Module][g.Name] = catalogue.ForeseenSealed
+					mark(m.Module, g.Name)
+				}
 			}
 		}
 		names := make([]string, 0)

go/compose/credentials_test.go

@@ -424,3 +424,26 @@ func TestGrantsComeInTheOrderOfProvisionConsumerModuleAndLocal(t *testing.T) {
 		t.Errorf("rows are %+v %v", rows, err)
 	}
 }
+
+// Round 1, finding 4: a member of a secret family a person gave, whose sealed value the Input does not carry, is placed with a
+// stand-in and named foreseen, not dropped as if nobody gave it.
+func TestAGivenFamilyMemberWithoutItsValueIsAStandInAndNamedForeseen(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["mailer"] = catalogue.Manifest{Module: "mailer", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"credential-*": {Path: "/var/lib/mailer/credential-*.secret", Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside}}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "mailer")
+	laptop.SealingKey = keyOf(t, "laptop")
+	in.OwnSecrets = []OwnSecretRow{
+		{Node: "laptop", Module: "mailer", Name: "credential-a", Origin: "accepted", SealedTo: laptop.SealingKey},
+		{Node: "laptop", Module: "mailer", Name: "credential-b", Origin: "accepted", SealedTo: laptop.SealingKey, Sealed: "b-sealed"},
+	}
+	got := rendered(t, in, "laptop", Foreseeing)
+	needed := got.Rendering.Needed["mailer"]
+	if needed["credential-a"] != catalogue.ForeseenSealed || needed["credential-b"] != "b-sealed" {
+		t.Errorf("needed %v", needed)
+	}
+	if !has(got.Foreseen, "mailer/credential-a") || has(got.Foreseen, "mailer/credential-b") {
+		t.Errorf("foreseen %v", got.Foreseen)
+	}
+}