Design 39 bus-and-switch: the licence manager keeps its data on the bus and switches on its own usage

The operator, 2026-11-11: the licence manager itself moves every consumer off a
licence at 99 % of its session or weekly window to the licence with the most
room, configurable, with its Postgres database replaced by bus state and tools
for all it keeps and does. That night a session meant to switch missed the
readings, so no session does it any more. The new milestone part writes every
line it builds (kept data, the one carry-over of today's rows, the vault move
of ADR 0550 §3, bindings and holdings as events, the switch, its warning and
condition, the tools, adding a licence), and names the three questions no
record settles; the main file is put in the shape a builder reads whole.

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

00-META/glossary.md

@@ -535,6 +535,11 @@ and the operator act. **Recorded by** the controller's `identity` and `licences`
   coding agent on a node (ADR 0183).
   Taking a consumer off a licence is **unbinding** it; the licence manager's verb for it is still
   `release`, an identifier to rename.
+- **room** of a licence — how much of its vendor's usage windows is still unused: 100 less the higher of its
+  session window's (five hours) and weekly window's percentage in its latest reading, known only for a subscription
+  read recently and healthy. The licence manager moves every consumer off a licence at its threshold to the one with
+  the most room (design 39 bus-and-switch §25, §26).
+  *Not:* ~~headroom~~
 - **proof** — what an authorising answer carries: a verified sender, a one-time code, a security key's
   touch (ADR 0234). How much proof a kind of ask needs is its **assurance level**.
 - **controller's terminal** — a command line the controller runs as typed by its operator, not asked through a
@@ -991,6 +996,10 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564, 0668.
   with its largest size in seven days by disk-load on that node, in its own state, one key
   `<node>.<module>.<item>` written only when it changes; the holder of `node-backup`, mounts, nfs-server and the
   self-check read them there, never the controller (ADR 0571 §5).
+- **carry-over** — a module's one copy of the data it kept in its old form into its bus state, at its first start
+  on the new form and before it does anything else, recorded in a key of its own so it is never copied again
+  (ADR 0437 §7; design 39 bus-and-switch §11 to §13). Not a take-over, which moves a job between parts.
+  *Not:* ~~data take-over~~
 - **sticky binding** — a consumer's tie to the data a provider keeps for it, which moves only by a
   person (ADR 0232).
 - **bus state** — what a module keeps on the bus, asked for in `requires` as a provision of the bus module, by a