The bus node follows the grants part's sealed user list from take-over, the controller's otherwise, never both (ADR 0547 clauses 7, 8; issue 1945)

On the node whose compositions carry the bus's list, the engine also watches mesh-grants' key user-list.sealed. While it
says follow grants, the object it names is read by name, opened with this machine's sealing key, checked against the
key's digest and the guard, and written to the same file at 0600 only when its digest differs; the bus reloads it
itself. The have says which list is followed and this machine's sealing key, which the grants part seals to.
The follower's test waits for its watch to catch up before a later put, which raced under load. Pins mesh-sdk 175a5567.

cmd/mesh-host/userlist.go

@@ -9,7 +9,10 @@ import (
 	"os"
 
 	"git.novox.be/novox/mesh-sdk/go/declaration"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/seal"
 	"github.com/novox/mesh-host/internal/apply"
+	"github.com/novox/mesh-host/internal/identity"
 	"github.com/novox/mesh-host/internal/link"
 	"github.com/novox/mesh-host/internal/store"
 	"github.com/novox/mesh-host/internal/system"
@@ -42,10 +45,37 @@ func userListFollower(opts options, session *link.Session, composedBucket string
 		Report: func(ctx context.Context, module string, w userlist.Written) {
 			session.NoteUserList(ctx, module, w)
 		},
+		// From take-over, the grants part's list (ADR 0547 clauses 7, 8): its one key watched, its object read by name and
+		// opened with this machine's sealing key, the key's public half said in the have so the grants part seals to it.
+		Grants: bucketWatch{session, delivery.GrantsUserListBucket},
+		Fetch: func(ctx context.Context, name string) ([]byte, error) {
+			return session.GrantsObject(ctx, name, grantsListLimit)
+		},
+		Open: func(b seal.Box) ([]byte, error) {
+			key, err := identity.LoadSealingKey(identity.SealingKeyPath(opts.state))
+			if err != nil {
+				return nil, err
+			}
+			return key.OpenVaultBox(b)
+		},
+		Key: func() string {
+			key, err := identity.LoadSealingKey(identity.SealingKeyPath(opts.state))
+			if err != nil {
+				return ""
+			}
+			pem, err := key.PublicPEM()
+			if err != nil {
+				return ""
+			}
+			return pem
+		},
 		Say: announceOr(say),
 	})
 }
 
+// grantsListLimit is the largest sealed list the bus node reads: the live list is about a hundred kilobytes.
+const grantsListLimit = 16 << 20
+
 // userListFile is a user-list resource as the file it declares.
 func userListFile(raw []byte) (*declaration.File, error) {
 	r, err := declaration.ParseResource(raw)