Design 47: take-over's test as ADR 0547's insight states it

2026-10-26 02:57:45 +01:00
parent d94f8a05a8
commit 5bdeb8db83
1 changed files with 3 additions and 2 deletions
@@ -184,8 +184,9 @@ there is three milestones, one issuer of each key at every moment (ADR 0547 §11
 1. **The list follows, the grants part in shadow** (issue 1945): the bus node applies the user list alone, with
   no want; mesh-sdk carries a copy of the bus composer, held byte for byte to the one release 6 runs; the grants
   part composes and compares in shadow with its tools; the vault hashes the bus accounts it is handed. The
-   operator's `take-over` makes the grants part's list the one loaded, and is refused while any user differs, so
-   it waits until the enrolment users and the persons have records on the bus (ADR 0547 §8).
+   operator's `take-over` makes the grants part's list the one loaded; it is allowed only when the users of both
+   lists are equal but for users placement no longer names, so it waits until the enrolment users and the persons
+   have records on the bus, and the second milestone waits for it (ADR 0547 §8, §11).
 2. **Nodes compose** (issue 1126): each node agent composes its own modules; no node applies a composition made
   elsewhere but the bus's user list until `take-over`.
 3. **Nothing is left with the controller** (issues 1126, 774): the vault mints bus accounts, the grants part