Designs 51, 32: name the manifest-reads grant and who holds the old-form window

The upgrade and security review asked that each window's caller be
granted the event through its invokes, that an away node be held by the
assigner rather than the old-form window, and that a node-engine not yet
serving manifest-reads keep a window open by name.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

03-DESIGN/01-to-be/32-what-a-module-declares.md

@@ -521,7 +521,11 @@ value it holds under the old name to the new name in its own state, without the
   the node-engine seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated
   capabilities change and when it returns after being away (ADR 0618 §4), as for the old seat name (design 51), and
   on it reads that node's stated capabilities through the seat's verb `manifest-reads` (ADR 0618 §3) and its applied
-  builds through `node_haves`, never a watch of the node-engine's have state (ADR 0596). ADR 0618 does not cover a
+  builds through `node_haves`, never a watch of the node-engine's have state (ADR 0596). mesh-config declares
+  `seat:node-engine.manifest-reads` in its `invokes`: that is the grant the grants part composes, and with it the
+  grants part grants mesh-config the subscription to the event's subject (its unit row is in design 51). A
+  node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays open and
+  the seat's verb `renames` names the node. ADR 0618 does not cover a
   returned node that applies the module's new build only after its return event, since that build changes what the
   module reads, not what the node-engine states: such a node closes the window on the next `delivered`, whichever
   delivery says it. A node holding a window open

03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md

@@ -84,7 +84,10 @@ applies the new build, with no other delivery: `distribution` also wakes on the
 `mesh.seat.node-engine.event.manifest-reads-changed`, which each node-engine says when the capabilities it states
 change and when its node returns after being away (ADR 0618 §4), and on it reads that node's stated capabilities
 through the seat's verb `manifest-reads` (ADR 0618 §3), and its applied build through `node_haves`, never a watch of
-the node-engine's have state (ADR 0596). A returned node that then applies the build whose node-engine reads the new
+the node-engine's have state (ADR 0596). `distribution` declares `seat:node-engine.manifest-reads` in its `invokes`:
+that is the grant the grants part composes, and with it the grants part grants `distribution` the subscription to
+the event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays
+open and `registry_old_name` names the node. A returned node that then applies the build whose node-engine reads the new
 names says the event again, as its stated capabilities change, so ADR 0618 covers every node of this window and no
 `delivered` is waited for. `cargo-package-registry` stays
 named, without a holder, until a build module publishes cargo packages.
@@ -385,10 +388,14 @@ that was away is held, never handed a form it cannot read. This is a window like
 reads each node's stated capabilities through the node-engine seat's verb `manifest-reads` (ADR 0618 §3) at its start,
 and wakes on the seat's event `mesh.seat.node-engine.event.manifest-reads-changed`, said when a node's stated
 capabilities change and when the node returns after being away (ADR 0618 §4), never on a watch of the node-engine's
-have state (ADR 0596) and never on a timer. Its tool `builder_old_form` lists whether the
+have state (ADR 0596) and never on a timer. The builder declares `seat:node-engine.manifest-reads` in its `invokes`:
-window is open and the nodes whose node-engine does not yet state the capability, and drops a retired node from it by
+that is the grant the grants part composes, and with it the grants part grants the builder the subscription to the
-hand, recorded as a hand act; a node holding it open for seven days is the builder's finding naming the node, cleared
+event's subject. A node-engine that does not yet serve `manifest-reads` counts as stating nothing: the window stays
-when the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes that held
+open and names the node. Only a present node-engine that has not updated holds this window; a node away is held by the
+assigner instead and is not listed as holding it. Its tool `builder_old_form` lists whether the window is open and the
+present nodes whose node-engine does not yet state the capability, and drops a retired node from it by hand, recorded
+as a hand act; a present node holding it open for seven days is the builder's finding naming the node, cleared when
+the window closes. Closing it says so in the build log and emits `old-form-closed` (the time, the nodes that held
 it last, the nodes dropped by hand) on the builder's own family beside `numbered`; a waiter on a build's end does not
 wake on it.
 
@@ -480,9 +487,11 @@ test).
   source other than the publish target) the floor finding is written and cleared once it answers, and with
   `bridge_tags` still silent after the by-digest publish, the build stays unnumbered until the forge bridge's health
   clears (no timer runs), and is then numbered and published by version; `builder_floor_again` asks the three
-  sources at once and records the hand act; the node-engine's done key stays in the old form while one node's
+  sources at once and records the hand act; the node-engine's done key stays in the old form while one present node's
-  node-engine lacks the capability and is written in the new form once every node states it, `builder_old_form`
+  node-engine lacks the capability, or does not serve `manifest-reads`, and is written in the new form once every
-  naming that node meanwhile and dropping it by hand with a hand act; a present node gaining the capability closes
+  present node states it, `builder_old_form` naming that node meanwhile and dropping it by hand with a hand act; with
+  one node away whose node-engine lacks the capability, the new form is written, the assigner holds that node's want,
+  and `builder_old_form` does not list it (ADR 0618 §1, §2); a present node gaining the capability closes
   that window on its `manifest-reads-changed` event with no `delivered` and no timer (ADR 0618 §2, §4), while a node
   away is held by the assigner from builds in the new form (ADR 0618 §1), with `old-form-closed` emitted
   and its build-log line written, and a waiter on a build's end does not wake on it; with the image's own seat silent
@@ -508,7 +517,9 @@ test).
   the seat it came through and that seat's holder; a change of the seat's holder composes the declaration again with
   the new holder named and recreates no container.
 - **The grants part, unit** (a case of its composition test): a node-engine's subscriptions hold the status view's
-  `settled` family beside the backup holder's word, and nothing more.
+  `settled` family beside the backup holder's word, and nothing more; the subscriptions of `distribution`, the builder
+  and mesh-config, each declaring `seat:node-engine.manifest-reads` in `invokes`, hold the subject
+  `mesh.seat.node-engine.event.manifest-reads-changed`, and no other module's subscriptions hold it.
 - **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the
   modules composed from their manifests instead, and the verb.
 - **Vault.** Reverting the milestone's merge mints the build modules' credentials again; the bootstrap's one-off