diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 53052594..7e474066 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -721,7 +721,9 @@ backup holder backs up nothing, and the have says so. in for a value its input lacks (an own secret, a credential, a vault box, the certificate) is refused whole, said, and the node keeps running what it runs; the bus's user list alone is held out of the apply, since the bus node follows it apart. So until a node's own secrets and credentials come sealed from the vault (ADR 0550 §5), a node - with any module holding one composes nothing of its own. + with any module holding one composes nothing of its own. Likewise a consumer of `model-access` answered by a + licence record, placed before the vault serves licences (ADR 0550 §3, issue 569), is refused by the same guard and + its node keeps what runs; none is placed today. - **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).