Design 39 bus-and-switch: the lead's answers to the prepare's 22 questions, each by the principles

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

03-DESIGN/01-to-be/39-milestones/bus-and-switch.md

@@ -447,3 +447,48 @@ tool's effect (the manifest's mark).*
     - every entry the manager keeps is read by `licences_kept`, and every act it takes by itself is started by a tool
       (§37 to §45);
     - live: a login to a new account on a node is adopted and listed with its usage (§46).
+
+## The lead's answers to the prepare's questions
+
+The prepare's design questions (2026-11-11), each answered by the lead in one line against
+[the principles](../../../00-META/principles.md), as the operator's way of working says. A developer builds these as
+written; they are cited as "design 39 bus-and-switch B*n*".
+
+- **B1** (`licence-put` is not in the vault's seat definition): the vault's seat definition in mesh-contracts gains the
+  verb, and mesh-contracts joins this milestone as a second member of its delivery group (P5).
+- **B2** (the validator refuses bus state by template from mesh-vault): `licence-bindings` stays in the vault's old
+  `state` section (P7).
+- **B3** (who may read a licence's grant): no machine guard on `licence-put` or `get`; the generation guard stays.
+  Inside the mesh every module is trusted, and who may do what is not a question (P6; the operator's instruction
+  who-may-is-not-the-operators-question).
+- **B4** (the manager has no vault key to seal to): two steps with a key made for the call, as `move-in` does (P7).
+- **B5** (the vault numbers generations itself): the caller's generation is the record's generation (P8).
+- **B6** (the vault takes only lower-case names): §10's key form is lower-case (P7).
+- **B7** (claude-code needs the licence's key and the account's identity): `binding.changed` and `current` carry `key`,
+  and `current` keeps `identity` (P1, P3).
+- **B8** (`get` names no consumer): the access token goes to machine M when any binding of a consumer on M names that
+  licence (P7).
+- **B9** (no line names the `invokes` entries or claude-code's `consumes mesh-vault.secret-changed`): each is declared
+  in its module's manifest (P1).
+- **B10** (`bindings` takes no `consumer`): an optional `consumer` argument; the §3 fields answered unpaged; the vault
+  reads it once at start (P7).
+- **B11** (one generation counter for every consumer): a counter per consumer, from the higher of its own and its
+  node's last reported generation; `GenerationsAbove` goes (P7).
+- **B12** (holdings unknown after a restart): the manager says `holdings.asked` at every start (P1).
+- **B13** (`offered` key holds a colon; two outcomes §5 does not list): the key goes through §10's key form, and all
+  five outcomes are kept (P7).
+- **B14** (`since` and `adoptedFrom` have no column; the live database's name): `since` is the carry-over's time,
+  `adoptedFrom` comes from the audit, and §14 checks the database the module's binding names (P7).
+- **B15** (§20 retires `grant-key`, §1 and A3 keep it): only the sealing at rest goes now; `grant-key` is retired in
+  the module's next change, with the store database (P7).
+- **B16** (`licence.bound`, `licence.released`, `licence.rotated`): dropped; `binding.changed` and the audit log
+  cover them (P8).
+- **B17** (the conditions' scope and id): scope `module`, id `claude-licence-manager` (P7).
+- **B18** (no mesh or node level for a module's own setting in mesh-config): the settings are the module's own values
+  on the manager's node, set and read through mesh-config as any module's own setting (P7).
+- **B19** (`current`'s health thresholds and §34's field names): failing at `failures_to_notify`, expiring within
+  `refresh_warn_days`; today's field names are kept (P7).
+- **B20** (the audit log is full): the act fails loudly and says so (P3).
+- **B21** (no tool reads the vault's `licence-bindings`): `vault_first_views` and `vault_first_view_again` cover it (P4).
+- **B22** (three internal forms): `bindings` stays at form 0; each reader decodes the event bodies with fixtures
+  copied from the writer; nothing to build for an inheriting consumer (P7).