@@ -16,7 +16,7 @@ Clause-②: no (narrowing)
 **Security fix for RLS reads on MongoDB and RLS write checks.** A policy written `record.status != ['closed', 'archived']` (or `!(record.status == [...])`, or `!=` against a `current_user` membership set) lowered to `{ status: { $ne: [...] } }` (or `$not` around a bare-array equality). The RLS `using` clause is composed into the query after the engine's comparand-shape check, and driver-mongodb passed the shape to the server, where it selects every scalar row: the read returned the rows the policy was written to hide. A `check` written `!=` against a membership set admitted every write.
 
 - `@objectstack/formula`: `compileCelToFilter` refuses `==` / `!=` whose comparand is a list (`unsupported`): a list literal, or a `current_user` variable that resolves to an array. The authoring shape check (`isPushdownableCel`, `isSupportedRlsExpression`) reports the literal; a resolved array is refused per request.
-- `@objectstack/plugin-security`: the RLS compiler drops such a policy and fails closed (`RLS_DENY_FILTER`: reads return no rows, `check` writes are refused 403). A CEL-authored `check` gets this 403; the `INVALID_FILTER` / 400 of `matchesFilterCondition` remains for a filter passed to it directly.
+- `@objectstack/plugin-security`: the RLS compiler drops such a policy and fails closed when no other policy applies (`RLS_DENY_FILTER`: reads return no rows, `check` writes are refused 403). A CEL-authored `check` gets this 403; the `INVALID_FILTER` / 400 of `matchesFilterCondition` remains for a filter passed to it directly.
 - `@objectstack/plugin-sharing`: a declared sharing rule with such a `condition` is skipped at bootstrap and never seeded.
 - `@objectstack/lint`: the list-literal form is reported (`rls-predicate-unenforceable`, `sharing-rule-unlowerable-condition`). The RLS reference pass probes each kernel-resolved `current_user` key with its runtime type.
 - `@objectstack/driver-mongodb`: `translateFilter` refuses `$ne` with an array comparand at any depth, with `INVALID_FILTER` / 400, as driver-sql and driver-memory already do.
 
@@ -33,7 +33,8 @@ export const entry: SemanticMigration = {
     + 'row storing a scalar, so the read returned the rows the policy was written to hide. A check '
     + 'written != against a membership set admitted and stored every write, on driver-sql as on '
     + 'driver-mongodb. The compiler now refuses the comparison with reason unsupported, so the RLS '
-    + 'compiler drops the policy and fails closed: reads under it return no rows and check writes '
+    + 'compiler drops the policy and fails closed when no other policy applies: reads under it '
+    + 'return no rows and check writes '
     + 'are refused 403. A declared sharing rule with such a condition is skipped at bootstrap and '
     + 'never seeded. The authoring lint reports a list literal as rls-predicate-unenforceable; a '
     + 'membership set holds its value only per request, so that form is refused at request time. '
 
@@ -6236,7 +6236,8 @@ const step18: MigrationStep = {
         + 'row storing a scalar, so the read returned the rows the policy was written to hide. A check '
         + 'written != against a membership set admitted and stored every write, on driver-sql as on '
         + 'driver-mongodb. The compiler now refuses the comparison with reason unsupported, so the RLS '
-        + 'compiler drops the policy and fails closed: reads under it return no rows and check writes '
+        + 'compiler drops the policy and fails closed when no other policy applies: reads under it '
+        + 'return no rows and check writes '
         + 'are refused 403. A declared sharing rule with such a condition is skipped at bootstrap and '
         + 'never seeded. The authoring lint reports a list literal as rls-predicate-unenforceable; a '
         + 'membership set holds its value only per request, so that form is refused at request time. '