5 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	feb32600bb	Hold a list or membership only when a seat would lose its last holder (issue 1945) ... Holding the user list on any loss would freeze it after take-over at the first release that drops a tool or moves a seat (ADR 0547 §7), with nothing to accept a deliberate loss; memberships had the same gap. The lead's decision in review round 1: one pure guard, Holdings.LastHolders, holds the list and each membership only when a seat held in force would have no holder in what is composed now while an assigned module still claims it, the 09:21 kind. A dropped tool, verb or field, or a seat handed to another node, is written.	2026-10-27 20:54:30 +01:00
jschoubben	4b23db28b3	mesh-grants: an open take-over ask is always closed (router record, expiry, failed publish, any outcome), the switch is said recorded not switched, the refusal condition is cleared, the excuse is limited to the claiming machines' subscriptions (issue 1945)	2026-10-26 11:43:39 +01:00
jschoubben	b0b1cf4f01	mesh-grants: a retired verb and a multiply claimed mesh seat's added subjects are named, not counted, in the comparison (issue 1945)	2026-10-26 11:34:52 +01:00
jschoubben	9132b6a296	mesh-grants: take each user's hash from the vault's bus-accounts and say per user whether one is held, so take-over waits until every user has a credential ... ADR 0547 clause 9: the vault writes the hash of each bus account it holds into bus-accounts.<user>. The grants part watches that state (no timer), carries the hash with each shadow user in memory only, and its user-list tool says per user whether a hash is held and how its line would differ from the loaded one (same, adds, left out for want of a credential, loses its login); never the hash, since bcrypt salts make two hashes incomparable. Take-over names the users with no hash. Issue: 1945	2026-10-26 02:29:54 +01:00
jschoubben	998fe3a515	Add mesh-grants in shadow: compose the bus's user list, memberships and assertions from the bus and compare, writing only its own state (ADR 0547 clauses 5-8, issue 1945) ... The grants part must compose with the controller's own composer before it can take over the list; in shadow it proves the two agree, names every input the bus does not carry yet, and takes no effect. It claims no seat (mesh-sdk's seat list does not name mesh-grants for the running composer), serves module tools, and keeps running when a read or write is refused.	2026-10-25 22:27:47 +01:00