Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

With no send left nothing else writes a missed grant, so the take-in of a done key returns it and tries again every
half minute under an urgent condition until it is written. plan-moved and sent go with the plans. The controller's
first-start deletions are said on a granted subject, a node hears only its backup holder, and the operator's account
writes the hand path, an object replaced included (ADR 0539 clauses 2, 7, 10 and 13).

internal/broker/nats.go

@@ -422,6 +422,11 @@ var DegradableGrants = []DegradableGrant{
 		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at its " +
 			"first push, and writes the chain only after that, holding the lease (ADR 0408 §2 and §8, issue 1089)",
 	},
+	{
+		Subject: "mesh.seat." + ControllerSeat + ".event.bucket-deleted",
+		Reason: "refused: nothing is deleted at genesis; the controller composes its own permissions into the bus module's " +
+			"composition before a later start's deletions (novox/hq ADR 0539 clause 13)",
+	},
 	{
 		Subject: "$KV." + delivery.ControllerComposedBucket + ".>",
 		Reason: "carried only at genesis: the controller composes its own permissions into the bus module's composition, " +
@@ -774,6 +779,15 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// And may ask what answers (novox/hq ADR 0197): a question every service answers about
 		// itself, its replies to the asker's own inbox.
 		pub = append(pub, discovering()...)
+		// And, for an administrator (`*`, the operator), release 6's hand path (ADR 0539 clauses 2 and 10): a want written
+		// at the terminal, and a composition made by hand with mesh-compose.
+		if administers(p.Invokes) {
+			hand, err := HandPathWrites(p.FilesFor)
+			if err != nil {
+				return Permissions{}, err
+			}
+			pub = append(pub, hand...)
+		}
 
 	case KindEnrolment:
 		// A leaked token is useless for anything but enrolling: it cannot read a declaration, hear