Answer A-386: a runner kept as it runs still gains the runner grants of what it carries

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

03-DESIGN/01-to-be/47-milestones/G-22-lead-answers-2.md

@@ -746,3 +746,100 @@ the principle that settles it, cited as "design 47 G A-n".
   on a cycle, so a call word's edge on a cycle is left out like an invoked verb's.
 - **A-362** (completes A-353; principles 3 and 7) The seat list a runner starts with (mesh-sdk's bootstrapped list)
   holds `mesh-delivery` beside `mesh-catalog`, so `mesh-delivery.source` is admitted before the seat list is read.
+- **A-363** (cycle C7; principles 7 and 2) While its catalog half is unread, grants composes each account from the
+  manifest the indexer's `modules` first view names for its module (the trunk's), in union with what its want's entry
+  gives, never from the list in force alone; so the first G parts get their G subjects before any of them serves.
+- **A-364** (completes A-363; principle 7) Grants' own account carries the right to create each kept event stream of
+  the seat list (`SEAT_*`, such as `SEAT_git_branch-moved`) while the catalog half is unread, composed the same way.
+- **A-365** (cycle C4, a silence of ADR 0573 §2/§4, which speaks of the latest published version; principle 7) A mesh
+  Go package no published version holds is built, for its importer, at the commit the gate's `source` names for its
+  repository, as an import of the same repository is; once a version is published, the latest published applies. The
+  indexer asks such a build with that commit, not on the version line.
+- **A-366** (W5; principles 7 and 3) The indexer takes its own build from `MESH_FINGERPRINT` (mesh-sdk
+  process.OwnBuild) first, and asks the node-engine's `composition` only when it is unset.
+- **A-367** (W22; principle 3) A planner of the catalog half (the bus keeper) treats a `none-yet` trunk as not yet
+  viewed: it plans nothing, deletes no plan and says no module orphaned until the first revision with entries.
+- **A-368** (C6; principle 7) When neither the registrations nor the gate's `source` name a branch (a fresh mesh),
+  the catalog half counts the trunk as `none-yet`, once in the catalog client's `Ready` for every part, so the approval
+  gate is ready and `indexer_seed_again` runs. In this release, since G's genesis needs it.
+- **A-369** (completes A-368; principle 7) Grants' own wait for its catalog half (`CatalogOf.Waiting`) asks the catalog
+  client's `Ready`, so a mesh that names no branch counts as `none-yet` for grants as for every other part.
+- **A-370** (cycle C8, found by dry run 2's baseline; principles 1 and 7) The indexer answers the first views of the seat
+  `mesh-catalog` (`registrations`, `revision`) at once from what its state holds, never held behind a running take-in;
+  a take-in that changes them says so on its events. So a runner's catalog half is read before the take-in's own calls
+  (such as the forge bridge's `bridge_merged_message`) reach it.
+- **A-371** (review r1 finding 1; completes A-364; principles 7 and 3) A first view grants reads from a seat stream that
+  does not exist yet, and that grants itself creates (such as `SEAT_node-engine_running`), is empty, not a wait: grants
+  composes the pass, writes its own right to create the stream with it, then creates the stream and hears it from its
+  start; its health says the stream was created after the pass.
+- **A-372** (completes A-368; principle 7) The assigner's wait for its catalog half (its `adopted` callback) asks the
+  catalog client's `Ready` as well, so a mesh that names no branch is `none-yet` for the assigner too.
+- **A-373** (live start, novox 21:56: "the value for list in mesh-grants_user-list is 422584 bytes, over the 262144 bytes
+  the bucket takes"; principles 1, 3 and 7) Grants keeps its user list and its pass result, which outgrow one value of a
+  key-value bucket, as objects in an object store of its own state (declared in its manifest like any kept data), the key
+  naming the object; a write that cannot be made stays loud as today.
+- **A-374** (completes A-373; principles 3 and 7) The seat verb `withheld`, served from grants' tools bundle, reads a
+  small key `withheld` that the process writes beside the list in its state `user-list` each pass it changes, so it
+  answers without the object the list became; before that key is first written it reads the list as before.
+  (Built in mesh-delivery d6d6bd18.)
+- **A-375** (live start, novox 22:28-22:44: grants "the first view seat:mesh-broker.list of the bindings is not answered
+  (Not run: the marks of nats are not read yet ...)", and the indexer runtime "was bound no object-store called
+  catalog-revisions ... bound: none"; extends A-359; principle 7) The gate's start path also lets through the seat
+  `mesh-broker`'s verb `list` (the bindings' first view) while the catalog half is unread, since the catalog half's own
+  owner is bound its bus state through it.
+- **A-376** (live start, novox 22:4x-23:0x: the indexer runtime "was bound no object-store called catalog-revisions";
+  the keeper plans nothing "before the catalog half's first views", which need that very store; cycle C12; completes
+  A-367 as A-363 completes grants; principles 7 and 3) Before its catalog half's first views are in, the bus keeper
+  makes the bus state of the holder of the seat `mesh-catalog` (the catalog half's own source), read from that module's
+  manifest on the trunk as the indexer's `manifests` first view gives it, and says each made entry as it does today, so
+  grants binds it; every other module waits for the catalog half as A-367 says.
+- **A-377** (live start, novox 22:26: grants' first views of the indexer's `modules`, `manifests`, `verdicts` "Not run:
+  the marks of mesh-delivery-indexer are not read yet"; the keeper's A-376 reads the same views; widens A-359 back toward
+  A-353; principle 7) While the catalog half is unread, the gate's start path also lets through each module's own
+  first-view tools (the tools its first views name, which a caller list already limits), besides the seat verbs of A-359
+  and A-375.
+- **A-378** (completes A-376; principle 7) The indexer's first views `modules` and `manifests` name the bus module (`nats`)
+  among their callers, so its keeper reads the catalog holder's manifest.
+- **A-379** (replaces A-376 and A-378 for the start: the indexer's `catalog-revisions` is declared in its manifest's
+  old `objects` section, which grants creates (records.go objectsOf, assertions.go), while the tool runner reaches an
+  object store only by a new-form binding (node-tools internal/bus/bindings.go objectStore), so nothing binds it;
+  principle 7: what exists) The tool runner reaches a module's object store by the binding when one is bound, and
+  otherwise by the old `objects` entry its membership names, under the bus name grants created for it
+  (`OBJ_<module>_<name>`); a name neither names stays refused as today.
+- **A-380** (corrects A-379's source of the name: grants issues no `objects` map in a membership; principle 7) With no
+  binding of that local name, the runner reaches the store under the name grants creates for a module's old `objects`
+  entry, `<module>_<name>` (stream `OBJ_<module>_<name>`); the bus's grants to the module's account decide whether it
+  may, and a refusal is said with the store's name.
+- **A-381** (live start, novox 23:42-23:58: grants is "Permissions Violation for Publish to $JS.API.STREAM.NAMES" while the
+  loaded list grants it STREAM.CREATE/INFO of each kept seat stream, so its assertion of the seats' kept events never
+  reaches the create and SEAT_mesh-conditions_findings-asked stays missing; every bundle with a finding writer exits;
+  principle 7) Grants' own account carries `$JS.API.STREAM.NAMES` (the read its assertion of kept streams starts with),
+  composed with the create rights of A-364.
+- **A-382** (widens A-381 to its kind, met a second time: live 00:02, every G bundle with a finding writer exits "no stream
+  on the bus carries mesh-conditions.findings-asked", because the tool runner's SubscribeNew finds a stream by subject
+  through `$JS.API.STREAM.NAMES`, which novox.node-tools may not publish, while EVENTS carries `mesh.seat.*.event.>`;
+  principles 7 and 6) Every account grants composes carries `$JS.API.STREAM.NAMES`, the read of stream names by subject
+  that hearing an event starts with; it lists names only.
+- **A-383** (completes A-382; live 00:21: list revision 274 loaded, yet novox.node-tools still lacks
+  `$JS.API.STREAM.NAMES` (1805 publish rights, unchanged), since grants keeps an account it holds "beyond this pass" as
+  the list in force while the catalog half is unread; principles 7 and 3) A right every account carries (A-382) is added
+  to every account grants writes, a kept one included: keeping an account in force never withholds what every account
+  is given. A pass that only adds still never takes from a loaded user.
+- **A-384** (completes A-382/A-383 for the whole hearing path, met a third time: live 00:35 "an ordered consumer of
+  mesh-conditions.findings-asked on EVENTS: context deadline exceeded", the runner account holds only INFO of named durables
+  on EVENTS; principles 6 and 7) Every tool runner account carries what the runner's SubscribeNew (an ordered consumer from
+  the next message, mesh-tools node-tools internal/bus/subscribenew.go) asks of the stream that carries the events its
+  bundles hear: the create of an unnamed consumer filtered to those events' subjects, its next-message fetch, its info and
+  its delete, on EVENTS and on every kept seat stream; the same form for every runner, composed in one place.
+- **A-385** (generalizes A-383, met a fourth time: live 01:00 "mesh-delivery-gate's bundle asked mesh/ledger.get and it
+  failed after 10s", the gate's ledger `records` exists and is bound, and novox.node-tools holds no right on
+  KV_mesh-delivery-gate_records_state, since a held runner account is copied whole from the list in force; principles 7
+  and 3; A-363's union) An account grants keeps beyond a pass, a runner's included, is written as the union of the list
+  in force and what this pass composes for it (its carried modules' grants from the trunk's manifests and their
+  bindings), never the list in force alone; a pass that only adds still never takes from a loaded user.
+- **A-386** (completes A-385 for runners kept as they run; live 01:31: grants 3c582b1b in, novox.node-tools unchanged
+  (2004 publish rights, none on KV_mesh-delivery-gate_records_state), since `runnerUsersKept` keeps a runner whose running
+  manifest does not say it is the tool runner whole (ADR 0601 §4); principles 7 and 3) A runner kept as it runs is written
+  as the union of the list in force and the runner grants its carried modules' bindings and events give (the ledger
+  readers, the new-event rights of A-384, the streams' names of A-382): what a carrying runner is given, never what a
+  plain module is given, so ADR 0601 §4 stands.