Design 55: readers by grant, the take-over refused while an Approve waits, the grants part's own test, §30 for nesting, the glossary's word in the review table

03-DESIGN/01-to-be/55-the-knowledge-base.md

@@ -592,10 +592,10 @@ milestones and nothing of how a delivery runs; it only listens for the announcem
 | An answer stays within its bound | the module's test over the full import of `main` at a recorded commit: every `ask`, `get` and `holds` of a fixed question list |
 | A record written in this repository meanwhile writes its clauses | `records.py`, check `clauses`, on every hq pull request, until the records left this repository (issue 426); since then `records.py`, check `no-records`, refuses any record written here |
 | Live | the acceptance sentence, asked from a session outside this repository |
-| A record is kept in the bus's forms, a section once by its digest, and read only as announced | one integration test that starts the module whole against a real bus server: a record of three sections and a second version changing one give one head, two version messages and four objects; a reader the manifest does not name is refused |
+| A record is kept in the bus's forms, a section once by its digest, and read only as announced | one integration test that starts the module whole against a real bus server: a record of three sections and a second version changing one give one head, two version messages and four objects; a module with no `grant` in `readers` is refused the streams and the object bucket |
 | Search answers from the index as it did from the store | a unit test over a fixed set of records and a fixed question list; the integration test restarts the module and asks again |
-| A draft is written by section and has one author, and a take-over tells the previous one | unit tests of each verb of § 4, of a refusal naming the author, and of `take-over` emitting `taken-over` |
-| A stream that keeps its history, and an object bucket of a module's own | in the integration test: a history stream at its cap refuses a new message and keeps its oldest, its condition raised at 75 percent and cleared below; an object no version or draft names is removed after a day, one still named is kept; unit tests of registration refusing a name already taken |
+| A draft is written by section and has one author, and a take-over tells the previous one | unit tests of each verb of § 4, of a refusal naming the author, and of `take-over` emitting `taken-over`; a take-over refused while the operator's Approve is waited for |
+| A stream that keeps its history, and an object bucket of a module's own | in the integration test: a history stream at its cap refuses a new message and keeps its oldest; an object no version or draft names is removed after a day, one still named is kept; unit tests of registration refusing a name already taken |
 | A long record is judged whole, one part at a time | unit tests: the frame never passes 16 KiB and says what it cut, with twenty clauses of 2000 bytes and a 40 KiB Context; every question stays under 60 KiB with a 40 KiB section and that frame, and the head part with 40 KiB of clauses; a section over 40 KiB is refused saying split it; an unchanged section keeps its review, a changed frame asks it again |
 
 **The fifth slice's tests, one per failure path** (ADR 0592; the review by architectural domain's testing ruling). Unit tests are
@@ -614,7 +614,7 @@ table-driven; one integration test starts the module whole against the real bus
 | a named digest has no object | unit: health unhealthy, naming it; the integrity tool restores it from given text |
 | a body does not hash to its name | unit: the read refuses it, naming the digest |
 | a full object bucket | integration: a write refused naming the cap; health unhealthy |
-| a full history stream | integration: `submit` refused with the head unchanged; the condition at 75 percent raised and cleared |
+| a full history stream | integration: `submit` refused with the head unchanged |
 | a judge timeout for one part | unit: that part stays asked and the version proposed, saying which; the others keep their verdicts |
 | a restart with parts asked | integration: the parts in `asked` are collected again and judged |
 | `reviewed` once per version | unit: one `reviewed` after the last `part-reviewed`, carrying every verdict |
@@ -623,6 +623,7 @@ table-driven; one integration test starts the module whole against the real bus
 | the move's check | unit: a changed review, a missing finding and a missing ask, each named |
 | writes during the switch | unit: every writing verb refused with its reason; reading verbs answer |
 | an older judge | the indexer's judge test (release sdk1): a manifest with `objects` or `retention: history` refused by a judge that does not know them, accepted by one that does |
+| the grants part's forms | the grants part's test (release sdk1), against a real bus server: an object bucket and a history stream created for their module; a read-only grant on that one bucket for a module named in `readers`, removed at the next composition once withdrawn; the condition at 75 percent raised and cleared below |
 | a reference | unit: "record › title › row" resolves to the section; a nested title is refused |
 | a form-only version | unit: accepted when only names and links changed and each target resolves; refused otherwise |
 | an unproven caller | unit: `open`, `write`, `submit`, `propose` and `take-over` refuse it |
@@ -685,7 +686,7 @@ clause instead); and the rules of how-we-build, which are not decision records.
 The fifth slice was reviewed by architectural domain on 2026-11-02 (four reviewers, two architectural domains each; the knowledge base's own
 review of ADR 0592's fourth version beside), and the lead ruled on every finding. What was found, and what answers it:
 
-| Aspect | Found | Answered by |
+| Architectural domain | Found | Answered by |
 |---|---|---|
 | security | unproven callers could write or take over; an Approve did not bind the sections shown; readers were named outside ADR 0363's grant (the knowledge base's review of version 6); a proposal waiting on the operator could be taken over; readers' grants and a body's match with its name were unsaid; a draft had no bound | ADR 0592 §4, §8, §9, §17, §19, §20, §21; § 2.1, § 4 |
 | seams | asked parts lived only in memory; told marks and reservations had no form on the bus; the judge's ticket is polled; who creates buckets and grants was unsaid; the judge is a module's tool, not a seat | ADR 0592 §2, §7, §16, §23; § 1, § 5 (the judge's seat a note on issue 1956), § 8.1 |
@@ -697,4 +698,4 @@ review of ADR 0592's fourth version beside), and the lead ruled on every finding
 | tools | unnamed objects, missing bodies, form-only versions, asked parts and told marks had no tool | ADR 0592 §32; § 1.1 (the tools table) |
 
 The knowledge base's review of the fourth version found that the reference form read as nested sections: ADR 0592
-§24 and § 2.2 say sections never nest.
+§30 and § 2.2 say sections never nest.