Gate and /_apps launcher call one predicate, so a runtime grant shows in the launcher

[thorwhalen]

The gate side of i2mint/enlace#35 (the enlace side landed in i2mint/enlace#56, released as enlace 0.1.41).

What was wrong

This plugin's gate allowed static allowed_users ∪ live runtime grants, compared case-insensitively. enlace core's /_apps launcher read only the static list, case-sensitively. A user granted access at runtime could open the app but never see it in the launcher. Every check read green, and all the user saw was a launcher with the app missing.

The fix

• PlatformAuthMiddleware's protected:user allowlist check now calls enlace.access.is_user_allowed, the same predicate the launcher calls. Grants are resolved by enlace.access.granted_users, which runs per request and fails closed when the grants store errors, as before.
• wire() builds one grants_resolver and hands it to both sides: to the gate (dynamic_allowed_users=) and to enlace core via parent.state.dynamic_allowed_users. There is no second implementation left to drift.
• The dependency is now enlace>=0.1.41.

Tests

tests/test_launcher_gate_agree.py runs the real gate and the real launcher side by side. It asserts "opens ⟺ listed" for static-only, grant-only, both and neither users, with mixed-case allowlists and grants, plus an open app (no allowlist). It also checks that granting, then expiring, reaches both sides without a restart. Without this change, the grant cases fail. An independent adversarial review confirmed that removing either the launcher's use of grants or the plugin's injection fails these tests.

Behaviour notes (from the adversarial review)

• A session record with no user_id is now refused by the gate, even for an open app. Every session creator sets user_id, so only a malformed record is affected. This is the stricter direction.
• The grants-failure warning keeps its text but is now emitted by the enlace.access logger, one line per failure, with the traceback at DEBUG.

Deploy note: bump the downstream lock's enlace and enlace_auth pins together.

https://claude.ai/code/session_01JQJh4hGdYjSKiFkyj9zrAh