@@ -16,7 +16,7 @@ Clause-②: no (narrowing)
 **Security fix for RLS reads on MongoDB and RLS write checks.** A policy written `record.status != ['closed', 'archived']` (or `!(record.status == [...])`, or `!=` against a `current_user` membership set) lowered to `{ status: { $ne: [...] } }` (or `$not` around a bare-array equality). The RLS `using` clause is composed into the query after the engine's comparand-shape check, and driver-mongodb passed the shape to the server, where it selects every scalar row: the read returned the rows the policy was written to hide. A `check` written `!=` against a membership set admitted every write.
 
 - `@objectstack/formula`: `compileCelToFilter` refuses `==` / `!=` whose comparand is a list (`unsupported`): a list literal, or a `current_user` variable that resolves to an array. The authoring shape check (`isPushdownableCel`, `isSupportedRlsExpression`) reports the literal; a resolved array is refused per request.
-- `@objectstack/plugin-security`: the RLS compiler drops such a policy and fails closed (`RLS_DENY_FILTER`: reads return no rows, `check` writes are refused 403).
+- `@objectstack/plugin-security`: the RLS compiler drops such a policy and fails closed (`RLS_DENY_FILTER`: reads return no rows, `check` writes are refused 403). A CEL-authored `check` gets this 403; the `INVALID_FILTER` / 400 of `matchesFilterCondition` remains for a filter passed to it directly.
 - `@objectstack/plugin-sharing`: a declared sharing rule with such a `condition` is skipped at bootstrap and never seeded.
 - `@objectstack/lint`: the list-literal form is reported (`rls-predicate-unenforceable`, `sharing-rule-unlowerable-condition`). The RLS reference pass probes each kernel-resolved `current_user` key with its runtime type.
 - `@objectstack/driver-mongodb`: `translateFilter` refuses `$ne` with an array comparand at any depth, with `INVALID_FILTER` / 400, as driver-sql and driver-memory already do.
 
@@ -14,8 +14,7 @@
  *     to exclude, which is what the lowered `$ne: [...]` (and the `$nor` of a
  *     negated equality) returned on driver-mongodb before the refusal;
  *   - a `check` write is refused with the row-level CHECK envelope
- *     (`PERMISSION_DENIED` / 403) and nothing is stored — before the refusal
- *     the resolved-array spellings ADMITTED the forbidden row here.
+ *     (`PERMISSION_DENIED` / 403) and nothing is stored.
  *
  * The controls are the spellings the refusal points at, `!(record.f in …)`,
  * which keep their exact meaning. The ground truth is read past every scope.
 
@@ -11,10 +11,10 @@ export const entry: SemanticMigration = {
   // No backticks in `surface` — build-upgrade-guide renders it inside a code
   // span already, and a nested backtick would close it.
   surface:
-    'security.PermissionSet rowLevelSecurity[].check (and .using, where the explain engine '
-    + 'attributes a record) — a CEL predicate comparing a field with != or == against a list, '
+    'security.PermissionSet rowLevelSecurity[].check — a CEL predicate comparing a field with != '
+    + 'or == against a list, '
     + 'a list literal or a current_user membership array, and the negation of such an ==. They '
-    + 'lower to { field: { $ne: [...] } }, { field: [...] } and { $not: { field: [...] } }, which '
+    + 'lowered to { field: { $ne: [...] } }, { field: [...] } and { $not: { field: [...] } }, which '
     + 'the @objectstack/formula evaluator matchesFilterCondition now refuses, together with '
     + '{ field: { $eq: [...] } }, at any depth under $and / $or / $not, the empty array included',
   replacement:
@@ -31,12 +31,9 @@ export const entry: SemanticMigration = {
     + 'membership array, matched EVERY post-image, and a check written '
     + '!(record.status == ["closed", "archived"]) did the same: every write such a policy was '
     + 'written to refuse was admitted and stored. The positive record.status == ["open", '
-    + '"pending"] refused every write (403). All of these shapes now fail the write with '
-    + 'INVALID_FILTER / 400 before any record is judged, the envelope driver-sql and '
-    + 'driver-memory already give the same shape on the read side, and the explain engine\'s '
-    + 'record attribution refuses too. The message withholds the field, the operator and the '
-    + 'value, because the filter is usually an access policy the caller did not write and the '
-    + 'comparand may be a resolved membership set. Metadata AT REST is not rewritten and this '
+    + '"pending"] refused every write (403). The evaluator now refuses all of these shapes '
+    + 'before any record is judged. The message withholds the field, the operator and the '
+    + 'value. Metadata AT REST is not rewritten and this '
     + 'entry adds no D2 conversion: the platform cannot tell which list operator a list '
     + 'comparison was standing in for, and a policy rewritten on the author\'s behalf would '
     + 'change which writes it admits (the negated forms would start refusing writes they '
@@ -46,7 +43,7 @@ export const entry: SemanticMigration = {
     'Grep the rowLevelSecurity check and using predicates of your permission sets for != or == '
     + 'whose right-hand side is a list literal or a current_user membership array, and for the '
     + 'negation of such an ==, then rewrite each with in or !(... in ...). A check that still '
-    + 'carries the shape refuses every write it governs with INVALID_FILTER / 400, allowed '
+    + 'carries the shape refuses every write it governs, allowed '
     + 'values included, so one allowed write under each policy finds every such check left. '
     + 'Then re-check what each policy is supposed to refuse rather than assuming the writes it '
     + 'admitted before were right: before this change a != or a negated == against a list '
 
@@ -11509,10 +11509,10 @@ const step18: MigrationStep = {
       // No backticks in `surface` — build-upgrade-guide renders it inside a code
       // span already, and a nested backtick would close it.
       surface:
-        'security.PermissionSet rowLevelSecurity[].check (and .using, where the explain engine '
-        + 'attributes a record) — a CEL predicate comparing a field with != or == against a list, '
+        'security.PermissionSet rowLevelSecurity[].check — a CEL predicate comparing a field with != '
+        + 'or == against a list, '
         + 'a list literal or a current_user membership array, and the negation of such an ==. They '
-        + 'lower to { field: { $ne: [...] } }, { field: [...] } and { $not: { field: [...] } }, which '
+        + 'lowered to { field: { $ne: [...] } }, { field: [...] } and { $not: { field: [...] } }, which '
         + 'the @objectstack/formula evaluator matchesFilterCondition now refuses, together with '
         + '{ field: { $eq: [...] } }, at any depth under $and / $or / $not, the empty array included',
       replacement:
@@ -11529,12 +11529,9 @@ const step18: MigrationStep = {
         + 'membership array, matched EVERY post-image, and a check written '
         + '!(record.status == ["closed", "archived"]) did the same: every write such a policy was '
         + 'written to refuse was admitted and stored. The positive record.status == ["open", '
-        + '"pending"] refused every write (403). All of these shapes now fail the write with '
-        + 'INVALID_FILTER / 400 before any record is judged, the envelope driver-sql and '
-        + 'driver-memory already give the same shape on the read side, and the explain engine\'s '
-        + 'record attribution refuses too. The message withholds the field, the operator and the '
-        + 'value, because the filter is usually an access policy the caller did not write and the '
-        + 'comparand may be a resolved membership set. Metadata AT REST is not rewritten and this '
+        + '"pending"] refused every write (403). The evaluator now refuses all of these shapes '
+        + 'before any record is judged. The message withholds the field, the operator and the '
+        + 'value. Metadata AT REST is not rewritten and this '
         + 'entry adds no D2 conversion: the platform cannot tell which list operator a list '
         + 'comparison was standing in for, and a policy rewritten on the author\'s behalf would '
         + 'change which writes it admits (the negated forms would start refusing writes they '
@@ -11544,7 +11541,7 @@ const step18: MigrationStep = {
         'Grep the rowLevelSecurity check and using predicates of your permission sets for != or == '
         + 'whose right-hand side is a list literal or a current_user membership array, and for the '
         + 'negation of such an ==, then rewrite each with in or !(... in ...). A check that still '
-        + 'carries the shape refuses every write it governs with INVALID_FILTER / 400, allowed '
+        + 'carries the shape refuses every write it governs, allowed '
         + 'values included, so one allowed write under each policy finds every such check left. '
         + 'Then re-check what each policy is supposed to refuse rather than assuming the writes it '
         + 'admitted before were right: before this change a != or a negated == against a list '