Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

With no send left nothing else writes a missed grant, so the take-in of a done key returns it and tries again every
half minute under an urgent condition until it is written. plan-moved and sent go with the plans. The controller's
first-start deletions are said on a granted subject, a node hears only its backup holder, and the operator's account
writes the hand path, an object replaced included (ADR 0539 clauses 2, 7, 10 and 13).

internal/broker/users.go

@@ -230,7 +230,12 @@ func Users(r Records) ([]Principal, error) {
 		out = append(out, Principal{Kind: KindEnrolment, Node: node})
 	}
 	for _, person := range sortedNames(r.People) {
-		out = append(out, Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]})
+		p := Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]}
+		if administers(p.Invokes) {
+			// The operator's hand path writes each node's compositions (ADR 0539 clause 10).
+			p.FilesFor = sortedCopy(r.Nodes)
+		}
+		out = append(out, p)
 	}
 
 	// Refused here rather than discovered by the server. Two users with one name is a file the