Package memba_bridge_v1 governs the ten Memba application realms published before memba_gov. It becomes each app's admin through the app's own two-step handover, so the apps' code does not change, and turns memba_gov approvals into the app's owner-only calls.
Every governed entrypoint is a direct call by a seated member. It reads the app's live pre-state, encodes it with the call's arguments and the app's tenure (how many times the bridge has accepted it), and consumes exactly that approval from memba_gov before calling the app: an approval voted on another state, app, action, argument or tenure never matches. Action ids are "<app>.<Op>"; the invalidation scope is the app, or an object of it where actions are independent.
Accept, ExpirePause and the reads need no vote. EmergencyPause needs a seated member, no vote, and expires by itself. Approval tells a proposer exactly what an entrypoint call would consume, from the same code.
