A static list is a permission time bomb
Hard-coding super names may be correct today, but super status is designed to flip during operation. A static array preserves old rights until deployment, and an open session may preserve them even longer.
Authorization must read current registry and flags at operation time. Approval at queue cannot automatically authorize take and write when status may change between those boundaries.
A flip does not stop stewardship
When a non-super becomes super, mirror, ledger, index, and Dad-facing UI continue. Only the actors allowed to place memory into a brain context change. Pippa's open curation session loses rights and terminates; the vault neither hides nor freezes.
The reverse flip does not resurrect old sessions. New operations may begin under new rights. Session identity and scope bind at claim while authorization is re-evaluated at each boundary.
The owner keeps rights to its own memory
Super does not mean nobody may see the vault. The soul itself has CRUD over its memory and Dad can manage all soul memory. Pippa's cross-soul semi-super access and every unrelated soul remain blocked.
Super souls remain mutually invisible. A claim on one super vault must not reveal another. The scope seal opens the claimed target and keeps every other protected vault closed.
Test revocation as a sequence
Startup truth tables are insufficient. Exercise session open, flag flip, next read denied, session terminated, and stewardship still healthy. Revocation is a protocol across time, not only a static matrix.
Also verify that background retries do not continue using cached payload. Context buffers, queued mutations, and temporary artifacts must close or be discarded when rights disappear.