fix(plugin-sharing): createLink asks the mint probe without two new isSystem reads

A system caller's read runs under the system context, and the probe admits
only on a row it re-reads the same way, so the two added checks bought
nothing and moved the system-context census. Pinned: a system caller keeps
its 404 for a missing record with the probe wired.

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-sharing/src/share-link-service.test.ts

@@ -1318,6 +1318,12 @@ describe('[ADR-0111 D8 rule 1 / ruling A′] mint authority: visibility, or the
     expect(link).toMatchObject({ record_id: 'c1', created_by: ADMIN });
   });
 
+  it('a system caller keeps its 404 for a missing record, with the probe wired', async () => {
+    await expect(service.createLink(mintIn('conversations', 'ghost'), { isSystem: true, userId: OWNER } as any))
+      .rejects.toMatchObject({ status: 404, code: 'RECORD_NOT_FOUND' });
+    expect(minted()).toEqual([]);
+  });
+
   it('visibility still admits on its own, without asking the owner/bypass probe', async () => {
     const link = await service.createLink(conversation(), as(READER));
     expect(link.created_by).toBe(READER);

packages/plugins/plugin-sharing/src/share-link-service.ts

@@ -599,7 +599,6 @@ export class ShareLinkService implements IShareLinkService {
     try {
       record = await readRecord(context.isSystem ? SYSTEM_CTX : context);
     } catch (err) {
-      if (context.isSystem) throw err;
       visibilityRefusal = err;
     }
 
@@ -611,7 +610,13 @@ export class ShareLinkService implements IShareLinkService {
     // the record is read under the system context: the caller's authority is
     // established, and the eligibility gate below must judge the row the
     // anonymous holder will be served (`resolveToken` reads it the same way).
-    if (!record && !context.isSystem && this.canMintWithoutVisibility) {
+    //
+    // A system caller reaches the probe only when its own system-context read
+    // found nothing or failed, and the probe grants it nothing it lacks: it
+    // admits only on a row it re-reads under that same system context. So a
+    // missing record still answers a system caller 404, and a failing read
+    // still fails.
+    if (!record && this.canMintWithoutVisibility) {
       const admitted = await this.canMintWithoutVisibility(input.object, input.recordId, context)
         .catch(() => false);
       if (admitted) record = await readRecord(SYSTEM_CTX);