Carry each contribution, composed, and the consumer's address in its plan entry, and let a process read another module's state, so route-proxy serves routes from the seat's plans alone (issue 774, research 072 row 34)

go/process/state_integration_test.go

@@ -353,6 +353,18 @@ func TestStateWatchRefusesAnUngrantedBucketNamingIt(t *testing.T) {
 	if err == nil || !errors.Is(err, nats.ErrPermissionViolation) || !strings.Contains(err.Error(), "mesh-mail_unrelated") {
 		t.Fatalf("Watch on an ungranted bucket: %v, want a refusal naming mesh-mail_unrelated", err)
 	}
+	// Another module's state, read as `reads` names it (issue 774): bound to its bucket, refused naming it when no read
+	// is granted; a name that is not <module>.<state> is refused before the bus is asked.
+	if _, err := adminJetStream.CreateKeyValue(ctxFor(t), jetstream.KeyValueConfig{Bucket: "mesh-provisioner_plans"}); err != nil {
+		t.Fatal(err)
+	}
+	err = conn.Read("mesh-provisioner.plans").Watch("", func(stdio.StateChange) error { return nil })
+	if err == nil || !errors.Is(err, nats.ErrPermissionViolation) || !strings.Contains(err.Error(), "mesh-provisioner_plans") {
+		t.Fatalf("Read of an ungranted state: %v, want a refusal naming mesh-provisioner_plans", err)
+	}
+	if _, err := conn.Read("plans").Get("x"); err == nil || !strings.Contains(err.Error(), "<module>.<state>") {
+		t.Fatalf("Read of a name that is no other module's state: %v", err)
+	}
 }
 
 // 1840/S1: given a process connection granted its bucket, when it deletes a key, then the key is gone and