@@ -431,6 +431,25 @@ export interface ShareLinkServiceOptions {
     recordId: string,
     context: ExecutionContext,
   ) => Promise<boolean>;
+  /**
+   * [ADR-0111 D8 rule 1 — ruling 5950188467, A′] Late-bound mint-authority
+   * probe (the sharing service's `canMintWithoutVisibility`): may the caller
+   * mint on a record their visibility read refused, because they are its
+   * OWNER or hold the explicit Modify-All bypass? `createLink` asks it only
+   * after that read refused. It answers with `canManageShares`' own owner and
+   * bypass branches and never with its hierarchy-depth branch, and it is
+   * withheld where an organization wall is in force.
+   *
+   * Absent → visibility alone admits (the pre-A′ rule), so a deployment
+   * without the sharing service never widens who may mint. A throwing probe
+   * is a refusal. It receives the caller's COMPLETE envelope, like every
+   * enforcement probe here.
+   */
+  canMintWithoutVisibility?: (
+    object: string,
+    recordId: string,
+    context: ExecutionContext,
+  ) => Promise<boolean>;
   /** [#5190] Optional logger for the record-delete cascade / orphan sweep. */
   logger?: {
     info?: (msg: any, ...rest: any[]) => void;
@@ -474,6 +493,7 @@ export class ShareLinkService implements IShareLinkService {
     recordId: string,
     context: ExecutionContext,
   ) => Promise<boolean>;
+  private readonly canMintWithoutVisibility?: ShareLinkServiceOptions['canMintWithoutVisibility'];
   private readonly logger?: ShareLinkServiceOptions['logger'];
   /**
    * [#12981] Latched by the FIRST refused usage stamp on this instance and
@@ -488,6 +508,7 @@ export class ShareLinkService implements IShareLinkService {
     this.hashPassword = opts.hashPassword ?? defaultHashPassword;
     this.verifyPassword = opts.verifyPassword ?? defaultVerifyPassword;
     this.canManageShares = opts.canManageShares;
+    this.canMintWithoutVisibility = opts.canMintWithoutVisibility;
     this.logger = opts.logger;
   }
 
@@ -501,11 +522,13 @@ export class ShareLinkService implements IShareLinkService {
     const schema = this.engine.getSchema?.(input.object);
     const policy = getPolicy(schema);
 
-    // [ADR-0111 D8] Mint authority = the object's `publicSharing` opt-in (this
-    // check) AND the caller's visibility of the record (the RLS-scoped read
-    // below). An object that opts into publicSharing deliberately delegates
-    // re-share power to anyone who can SEE the record — a stated decision, not
-    // an accident. Objects that do not opt in cannot be link-shared at all.
+    // [ADR-0111 D8 rule 1] Mint authority = the object's `publicSharing` opt-in
+    // (this check, FIRST) AND — after the request-shape checks below — the
+    // caller's authority over the record: visibility (the RLS-scoped read), or
+    // the record owner, or an explicit Modify-All bypass (ruling 5950188467,
+    // A′). An object that opts into publicSharing deliberately delegates
+    // re-share power to anyone who can SEE the record. Objects that do not opt
+    // in cannot be link-shared at all, by their owner included.
     if (!policy.enabled && !this.permissive && !context.isSystem) {
       throw makeError(
         422,
@@ -537,10 +560,11 @@ export class ShareLinkService implements IShareLinkService {
     }
 
     // Confirm the target record exists AND — for an HTTP caller — that the
-    // caller may actually SEE it. [Finding-2] Reading under the caller's own
-    // context (positions/permissions/RLS) means you can only mint a link for a
-    // record you can access; a client can no longer share arbitrary rows of a
-    // publicSharing-enabled object it cannot see. Internal (isSystem) callers
+    // caller holds authority over it. [Finding-2] Reading under the caller's
+    // own context (positions/permissions/RLS) means a client can no longer
+    // share arbitrary rows of a publicSharing-enabled object it cannot see;
+    // the only callers who mint past a refused read are the record's owner and
+    // an explicit Modify-All holder (A′, below). Internal (isSystem) callers
     // read under the system context as before.
     //
     // [commit 8e13ca876] `context` is passed through UNCHANGED — it is the caller's whole
@@ -556,32 +580,59 @@ export class ShareLinkService implements IShareLinkService {
     // a second query being issued, and it widens ONLY then, so an object
     // without the key keeps the exact `id`-only read it always had.
     const eligibility = policy.enabled ? policy.eligibility : undefined;
-    const exists = await this.engine.find(input.object, {
-      where: { id: input.recordId },
-      ...(eligibility ? {} : { fields: ['id'] }),
-      limit: 1,
-      context: context.isSystem ? SYSTEM_CTX : context,
-    } as any);
-    if (!Array.isArray(exists) || exists.length === 0) {
+    const readRecord = async (readContext: ExecutionContext | typeof SYSTEM_CTX) => {
+      const rows = await this.engine.find(input.object, {
+        where: { id: input.recordId },
+        ...(eligibility ? {} : { fields: ['id'] }),
+        limit: 1,
+        context: readContext,
+      } as any);
+      return Array.isArray(rows) ? (rows[0] as Record<string, unknown> | undefined) : undefined;
+    };
+
+    // Visibility first. A refusal the read THROWS (the CRUD gate's, on an
+    // object the caller holds no read grant on) is kept, not swallowed: it is
+    // re-thrown below unless an alternative admits, so a caller refused before
+    // A′ is refused with the same envelope after it.
+    let record: Record<string, unknown> | undefined;
+    let visibilityRefusal: unknown;
+    try {
+      record = await readRecord(context.isSystem ? SYSTEM_CTX : context);
+    } catch (err) {
+      if (context.isSystem) throw err;
+      visibilityRefusal = err;
+    }
+
+    // [ruling 5950188467, A′] The owner and Modify-All alternatives, asked only
+    // once visibility has refused. The probe is the sharing service's
+    // `canMintWithoutVisibility`: `canManageShares`' owner and bypass branches
+    // WITHOUT its hierarchy-depth branch — a hierarchy manager still needs
+    // visibility to mint — and withheld under an organization wall. Admitted,
+    // the record is read under the system context: the caller's authority is
+    // established, and the eligibility gate below must judge the row the
+    // anonymous holder will be served (`resolveToken` reads it the same way).
+    if (!record && !context.isSystem && this.canMintWithoutVisibility) {
+      const admitted = await this.canMintWithoutVisibility(input.object, input.recordId, context)
+        .catch(() => false);
+      if (admitted) record = await readRecord(SYSTEM_CTX);
+    }
+
+    if (!record) {
+      if (visibilityRefusal !== undefined) throw visibilityRefusal;
       // Don't distinguish "missing" from "not visible" for an untrusted caller.
       throw context.isSystem
         ? makeError(404, 'RECORD_NOT_FOUND', `${input.object}/${input.recordId} does not exist`)
         : makeError(403, 'FORBIDDEN', `Not permitted to share ${input.object}/${input.recordId}`);
     }
 
-    // [#7861] The declared eligibility gate. Placed AFTER the visibility read
-    // (it needs the record, and a caller who cannot see the row must not learn
-    // anything about its contents from the refusal) and BEFORE the insert, so
-    // an ineligible link is never MINTED — which is the only placement that
-    // helps, since `resolveToken` serves an existing row anonymously under
-    // `SYSTEM_CTX` with no auth check to fall back on.
+    // [#7861] The declared eligibility gate. Placed AFTER the authority check
+    // (it needs the record, and a caller with no authority over the row must
+    // not learn anything about its contents from the refusal) and BEFORE the
+    // insert, so an ineligible link is never MINTED — which is the only
+    // placement that helps, since `resolveToken` serves an existing row
+    // anonymously under `SYSTEM_CTX` with no auth check to fall back on.
     if (eligibility) {
-      assertEligible(
-        eligibility,
-        (exists[0] ?? {}) as Record<string, unknown>,
-        schema,
-        input.object,
-      );
+      assertEligible(eligibility, record, schema, input.object);
     }
 
     const maxDays = policy.maxExpiryDays ?? DEFAULT_MAX_EXPIRY_DAYS;
 
@@ -869,6 +869,13 @@ export class SharingServicePlugin implements Plugin {
           canManageShares: this.service
             ? (o, r, c) => this.service!.canManageShares(o, r, c as any)
             : undefined,
+          // [ADR-0111 D8 rule 1, ruling 5950188467 (A′)] The record's owner and
+          // an explicit Modify-All holder may mint where the visibility read
+          // refuses them: `canManageShares`' own owner and bypass branches,
+          // without its hierarchy-depth branch.
+          canMintWithoutVisibility: this.service
+            ? (o, r, c) => this.service!.canMintWithoutVisibility(o, r, c as any)
+            : undefined,
         });
         ctx.registerService('shareLinks', this.linkService);
 
 
@@ -365,6 +365,17 @@ export interface SharingServiceOptions {
   };
 }
 
+/**
+ * [ADR-0111 D1] What `SharingService.ownerOrBypass` concluded about a record:
+ * the caller owns it or holds the Modify-All bypass (`admit`), there is
+ * nothing to decide on (`refuse`), or neither branch applies and the record's
+ * `owner` is handed on to the DEPTH branch (`undecided`).
+ */
+type OwnerOrBypassVerdict =
+  | { readonly kind: 'admit' }
+  | { readonly kind: 'refuse' }
+  | { readonly kind: 'undecided'; readonly owner: unknown };
+
 /**
  * Default `ISharingService` implementation.
  *
@@ -950,31 +961,15 @@ export class SharingService implements ISharingService {
     context: ExecutionContext,
   ): Promise<boolean> {
     if (context?.isSystem) return true;
-    if (!object || !recordId || !context?.userId) return false;
 
-    // Ownership — read under system context so field-level masking cannot
-    // hide the owner column from the decision itself. Keep the owner value:
-    // the DEPTH branch below reuses it rather than re-reading the row.
-    let owner: unknown;
-    try {
-      const rows = await this.engine.find(object, {
-        where: { id: recordId },
-        fields: ['id', OWNER_FIELD],
-        limit: 1,
-        context: SYSTEM_CTX,
-      });
-      const row: any = Array.isArray(rows) ? rows[0] : undefined;
-      if (!row) return false;
-      owner = row[OWNER_FIELD];
-      if (owner != null && String(owner) === String(context.userId)) return true;
-    } catch {
-      return false;
-    }
-
-    // Modify All Data — the EXPLICIT bypass only (ADR-0111 D1/D2; never the
-    // effective write scope, whose unmatched-object case fails open to 'org').
-    // [#4647] Shared with `canEdit`/`canDelete` so the three gates cannot drift.
-    if (await this.hasModifyAllBypass(object, context)) return true;
+    // The record owner and the Modify-All bypass, read in `ownerOrBypass` —
+    // the two branches this gate shares with mint authority
+    // (`canMintWithoutVisibility`). A verdict there is final; `undecided`
+    // hands the owner value on, so the DEPTH branch below does not re-read
+    // the row.
+    const direct = await this.ownerOrBypass(object, recordId, context);
+    if (direct.kind !== 'undecided') return direct.kind === 'admit';
+    const owner = direct.owner;
 
     const probe = this.securityService?.();
 
@@ -1001,6 +996,92 @@ export class SharingService implements ISharingService {
     return false;
   }
 
+  /**
+   * [ADR-0111 D8 rule 1 — ruling 5950188467, A′] May `context` mint a share
+   * link on `(object, recordId)` WITHOUT being able to see it?
+   *
+   * Mint authority is "visibility, or the record owner, or an explicit
+   * Modify-All bypass". The link service runs the visibility read itself; this
+   * answers the other two alternatives, and it answers them with
+   * {@link canManageShares}' own first two branches (`ownerOrBypass`) — the
+   * same owner column and the same `hasWriteBypass` probe, so there is one
+   * notion of ownership, not two.
+   *
+   * ## What it deliberately leaves out
+   *
+   * **The hierarchy-depth branch.** A manager whose write DEPTH covers the
+   * owner manages the record's shares (revoke, grant, list — D8 rule 2), but a
+   * link CREATES access, and that manager may hold write depth over a record
+   * the data door will not let them read. Admitting them would let minting
+   * outrun reading; so a hierarchy manager still needs visibility to mint. This
+   * method never calls `resolveWriteScope` or the hierarchy resolver.
+   *
+   * **A deployment that walls organizations.** Under the `group` / `isolated`
+   * postures the visibility read applies Layer 0 (ADR-0095 D1 / ADR-0105 D1),
+   * and neither alternative here knows the record's organization: the owner
+   * column outlives a membership, and `hasWriteBypass` is object-wide. So where
+   * a wall is in force both alternatives are withheld and visibility alone
+   * admits — a member who left an organization cannot mint a public link to a
+   * record they still own in it. The posture is the one
+   * {@link organizationScopeRequired} reads, fail-closed: an unresolvable
+   * posture counts as walled.
+   *
+   * Everything else fails CLOSED to `false`: a missing record, a
+   * principal-less context, a failed read or probe.
+   */
+  async canMintWithoutVisibility(
+    object: string,
+    recordId: string,
+    context: ExecutionContext,
+  ): Promise<boolean> {
+    if (this.organizationScopeRequired()) return false;
+    return (await this.ownerOrBypass(object, recordId, context)).kind === 'admit';
+  }
+
+  /**
+   * [ADR-0111 D1] The record OWNER and the explicit Modify-All bypass — the
+   * branches {@link canManageShares} and {@link canMintWithoutVisibility} both
+   * read, written once.
+   *
+   * `admit`: the caller owns the record, or holds `modifyAllRecords` on the
+   * object. `refuse`: there is nothing to decide on — no object, record or
+   * user identity, no such record, or the owner read failed. `undecided`: the
+   * record exists and the caller is neither; `owner` is carried for the DEPTH
+   * branch, which only `canManageShares` consults.
+   *
+   * Ownership is read under the system context so field-level masking cannot
+   * hide the owner column from the decision itself. The bypass is the EXPLICIT
+   * one only (ADR-0111 D1/D2; never the effective write scope, whose
+   * unmatched-object case fails open to 'org'), shared with `canEdit` /
+   * `canDelete` [#4647] so the gates cannot drift.
+   */
+  private async ownerOrBypass(
+    object: string,
+    recordId: string,
+    context: ExecutionContext,
+  ): Promise<OwnerOrBypassVerdict> {
+    if (!object || !recordId || !context?.userId) return { kind: 'refuse' };
+
+    let owner: unknown;
+    try {
+      const rows = await this.engine.find(object, {
+        where: { id: recordId },
+        fields: ['id', OWNER_FIELD],
+        limit: 1,
+        context: SYSTEM_CTX,
+      });
+      const row: any = Array.isArray(rows) ? rows[0] : undefined;
+      if (!row) return { kind: 'refuse' };
+      owner = row[OWNER_FIELD];
+      if (owner != null && String(owner) === String(context.userId)) return { kind: 'admit' };
+    } catch {
+      return { kind: 'refuse' };
+    }
+
+    if (await this.hasModifyAllBypass(object, context)) return { kind: 'admit' };
+    return { kind: 'undecided', owner };
+  }
+
   /**
    * [ADR-0111 D5] Is `(object, recordId)` VISIBLE to the caller? Reads under
    * the CALLER's own context so the security RLS and sharing read filters