Intended use is for transitory moons to be able to breach themselves on
startup.
If you run a moon without persistence, then every time the program is
restarted, it must be breached. This lets the moon breach itself
instead of requiring direct interaction with the planet. The moon
should reserve the first bone for this purpose, and then every time it
starts up, it should send [%helm-moon-breach ~moon-name] to hood on the
planet.
No mark files exist for any of the drum marks, so trying to poke remote drums
would fail anyway, but relying on the mark system in that way seems a bit
fragile, so we add an explicit permission check.
No mark files exist for any of the helm marks (except `%helm-hi`), so trying to
poke remote helms would fail anyway, but relying on the mark system in that way
seems a bit fragile, so we add an explicit permission check.
When we receive a commit that we can apply from the source, we throw
away any skipped pending commits. This lets us receive updates at the
current kelvin even if we heard pending commits for later kelvins.
If a desk is suspended/paused/local, then we should exclude it when
bumping in the +on-load, because a suspended/paused/local desk cannot
have a pending commit that would allow it to bump successfully.
Previously this wasn't accounting for the "couldn't read kelvin from
local desk" case properly, resulting in crashes during updates to base,
after which other desks wouldn't be started back up.
We do not care about what's on foreign, the local desk is the thing
we're taking action on. This is more robust in the face of absent
information about foreign desks etc.
Also stops pretending to take-commet during take-merge-main. We'll get a
separate commit event.
Remote install send a %commit because they receive new files. Local
installs never receive files, so weren't notifying kiln subscribers.
Here we "manually" send a %commit fact when installing a local desk.
