Keep holding a membership that would drop a capability its holder still asks for (issue 1945)

A dropped verified-sender comes from a root-free word that failed for one pass, not from a release, and losing it cut the operator's approvals on 2026-10-27. Holdings.CapabilitiesLost holds such a membership with its own reason while the holder is assigned and its manifest still asks for it; a dropped tool or field and a moved seat stay published.
2026-10-27 20:56:09 +01:00
parent feb32600bb
commit ec0b7e2dcc
4 changed files with 76 additions and 13 deletions
@@ -86,7 +86,8 @@ func toolsOf(p *grants.Part) []stdio.Tool {
 			"the assertions, publish each membership that differs from the one last published, and keep what changed in its own " +
 			"state (one revision when an input changed, none when not), saying user-list-changed and membership-changed. Answers " +
 			"the ask and the last pass; grants_user_list shows the pass that answers it. A membership is published unless it would " +
-			"leave a seat a placed module claims with no holder, which stays a shadow difference, named. The user list, assertions and " +
+			"leave a seat a placed module claims with no holder, or drop a capability its holder still asks for (verified-sender), " +
+			"which stays a shadow difference, named. The user list, assertions and " +
 			"grants stay in shadow. It cannot ask the controller to write a module's grant again: the controller serves no such " +
 			"verb, and the answer says so.",
 			Run: func(a map[string]any) (any, error) { return p.AskCompose(stdio.CallerOf(a)) }},