Pin the delegation-mode semantics

Shipped

August 11, 2026 at 1:16 AM UTC

Author

Kamo

Commit

44da65a

These predicates are what the surfaces hide themselves on, so getting one wrong either offers a button that cannot work or silently permits a charge the owner meant to forbid. An unreadable stored value falls back to central billing — failing safe here means failing closed.