Development record

A cutter whose copy pushes through an app (a hosted session's installation token) records every withdrawal on a commit an app pushed, so abcd can neither admit nor re-arm any of them: each is named app_pushed once and left for the person to re-arm by hand after the cut. Whether such a copy should withdraw at all, or how its withdrawals could be vouched for, needs a design decision.