The vault's get judges a licence's secret by a rule of its own, before the asker rule: a grant goes to any proven caller, and an access token to a machine on which a consumer's binding in licence-bindings names that licence's key; a refusal names the rule and is recorded. Builds: design 39 bus-and-switch §16, §17, A1, B3, B8, B25 Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ