Archived
jschoubben
ee1b8ffe24
The derivation had nothing feeding it. `BusRecords` reads what it needs — the machines, what each runs, every manifest, and which machines hold a live token — and turns it into the records the composer derives from. **A module's authority comes from its manifest, not from its assignment.** The assignment says where it runs; what it may say is what it declared. So the two are read together and the manifest decides, which is also why a seat's protocol is gathered across the whole catalogue rather than from one manifest: a seat is declared by one module and held by another, and that is the whole reason a seat exists. Three things checked against a real store, each a user that would be wrong in a way nothing reports: - A module assigned to a machine becomes a user with exactly the authority it declared, including the protocol of a seat some *other* module declared — a module granted nothing on a seat it was assigned to send to would fail on its first publish with an authorisation error that says nothing about a seat. - Only a machine holding a live token gets an enrolment user. One outliving its token is a right to join that nobody issued. - A module assigned and absent from the catalogue is refused rather than composed with an empty permission list. The catalogue already refuses to forget an assigned module, so this is the second line — and it earns its place there, because relying on another package's invariant is how a rule ends up enforced by nothing. People are left empty rather than guessed at: the account model is built and `operator issue` is not, so there is nobody to derive yet.