The idea
A liminal is an agent in Lys and holds its own pass, which it renews. Subjects it serves are placed under its network in Lys by the server itself, with its app credential, so that grants can name them. A seat’s ticket speaks the wire with the seat’s pass; the console speaks the WebSocket with the server’s token.
Why it matters
There is one place to grant and one place to revoke. A wrong refusal is a defect to fix at its cause, never worked around with a second list.
How it works
The wire admits only a pass. A tool refusal from the ticket carries the server’s words and names the subject. The server’s placement of a tap subject is journalled beside the store, so a second boot makes no placement call for a subject it has already placed.