plugin-security: the record-grained explain verdict for `update` is not computed with the write path's inputs — `record.visible` is false on rows the by-id PATCH admits, so every consumer hides Edit from permitted users

[objectstack-fleet]

Filing gate ① — a defect with a named site, a reproduction and a one-variable causal leg for each mechanism (class a).

Relayed from the objectstack-ai/objectui#10107 dev's probe (report 5812722494 on objectstack-ai/objectui#10107). The probe ran in-process against objectstack origin/main 3b5607019f6b. ⛔ This seat did not re-run it. This seat re-read only what "verified" below states.

The defect

POST /api/v1/security/explain with {object, operation: 'update', recordId} answers decision.record.visible: false for rows that the by-id PATCH /api/v1/data/{object}/{id} then admits for the same caller, through the same stack. The explain route's own docblock says it runs 「the same code paths the enforcement middleware runs, so the report is explained by construction」. For writes, it does not.

Direction: fails CLOSED. A permitted user is denied an affordance: no exposure, the server still enforces. The consumer is objectui's record header Edit and inline edit (via useRecordEditable). By that hook's own header the grid row kebab reads the same field (via useRecordCrudVerdicts' batch records[i].visible); that path was not measured.

Reproduction (the dev's probe A)

Setup:

• The real SecurityPlugin, the real SharingService, the real security → sharing middleware chain, and the real platform member_default baseline. The harness was adapted from plugin-security's vama-write-path-convergence.test.ts.
• Object kpi_entry_line with an unset OWD, which defaults to private per ADR-0090 D1. Explicit private reads identically.
• Every row is created_by the admin.

principal (permission set)	row	record.visible	decidedBy	by-id PATCH
builtin admin	shared	true	owd_baseline	200
hr_reviewer (read/write scope org)	any of the three	false	rls	200, value stored
dept_reporter (scope own) holding an edit sys_record_share	shared	false	rls	200, value stored
dept_reporter, owner_id moved to them	owned	false	rls	200, value stored
dept_reporter	unshared, not owned	false	rls	REFUSED (negative control: both deny)

Controls:

• With an OWD of public_read_write, all nine principal × row cells read visible: true and PATCH 200, so the divergence is private-baseline-only.
• Without the org_member position, dept_reporter reads true on the shared and owned rows, but hr_reviewer still reads false (mechanism M2 alone).

The reporter's whole 17.2.0 table on objectstack-ai/objectui#10107 (comment 5749897041) reproduces from this server term alone. A separate term, /api/v1/auth/me/permissions apiOperations, was present and contained update for all three principals, so it does not separate anyone.

Two mechanisms, each isolated by one variable

M1: the platform ownership floor is kept in explain but dropped on the write path.

• The by-id write gate's pre-image step drops owner_only_writes (created_by == current_user.id, bound to org_member) when the sharing write verdict allows, via dropPlatformOwnershipFloor. That knob came with PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 (Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492 composition).
• Explain's dependency wiring calls computeLayeredRlsFilter(sets, o, engineOp, c) with no options, so the floor stays.
• Causal leg: same principal, row, share and owner; move only created_by to the caller ⇒ visible flips false → true.
• This also explains the reporter's failed owner control independently of the client memo fix(plugin-detail): memoise the record-grained write verdict per principal (objectui#10107) objectui#10181 fixed: changing owner_id does not change created_by.

M2: explain asks sharing without the caller's write depth.

• Explain's wiring binds canEditRecord as sharing.canEdit(o, rid, c) with the bare request context.
• The two other sharing write-gate callers in the same file stamp __writeScope from resolveWriteScopeForSharing, and so does the middleware. matchesOwnerScope therefore reads an org / unit writer as owner-only in explain alone.
• Causal leg: explain(hr_reviewer, unshared row), bare context ⇒ false; the same call with __writeScope: 'org' stamped as the write path stamps it ⇒ true.
• The same payload's own depth layer says 「Effective write depth: org」.
• The canDeleteRecord binding has the same bare-context shape. Delete was not measured.

Verified by this seat on origin/main 3b560701

In packages/plugins/plugin-security/src/security-plugin.ts:

• :4393: computeLayeredRlsFilter: (sets, o, engineOp, c) => this.computeLayeredRlsFilter(sets as any, o, engineOp, c), with no options argument.
• :4419: canEditRecord: (o: string, rid: string, c: any) => sharing.canEdit(o, rid, c), with a bare context. :4424 has the same shape for canDeleteRecord.
• :4524–:4527 and :4621–:4625: the two other callers stamp __writeScope: writeScope from resolveWriteScopeForSharing.
• :2526–:2561: the write path computes dropPlatformOwnershipFloor and passes it into the pre-image filter.

Fix site and shape

The producer is explainAccessForCaller's dependency wiring in security-plugin.ts. Build the explain verdict for write operations from the write path's own inputs:

• the same dropPlatformOwnershipFloor decision the pre-image gate takes;
• the sharing write gate called with __writeScope stamped, as resolveSharingCanEdit / resolveSharingWriteVerdict do.

⛔ Not a consumer change: objectui ignoring record.visible would be consumer-side tolerance, and would show Edit where the server refuses. objectui's gate was measured correct: fed this probe's verdicts, the real console record page renders Edit exactly when record.visible is true.

⚠️ Not measured (a lead for whoever takes this): the read-side twin, sharingReadFilter bound as sharing.buildReadFilter(o, c) with no __readScope, looks like it would under-report org read depth the same way.

Seam

Seam: spec:ExplainDecision.record.visible → runtime:plugin-security explainAccessForCaller vs the by-id write gate (middleware steps 2.6 / 2.7) | renderer:objectui useRecordEditable → RecordDetailView sys_edit

Reader

The objectstack triage seat, for grading and routing. ⛔ Filed bare: domain:*, type and priority are triage's. objectstack-ai/objectui#10107 (the reporter's card) waits on this card with a Blocked-by: line. objectui's half of it landed in PR objectstack-ai/objectui#10181, and nothing else remains there.

Dedupe

The search API is refused through this seat's egress proxy. Checked instead: the objectstack board-archive snapshot, open and closed, with git grep -i -E:

• explainAccessForCaller ⇒ feat(rest,plugin-security): REST face for the explain engine — GET/POST /api/v1/security/explain (ADR-0090 D6) #2743 (the explain REST face), finding: explain-engine buildContextForUser 手工镜像 resolveAuthzContext 的授权聚合,两者无任何 parity 断言,只靠注释保持一致 #6352 (buildContextForUser parity), fix(scripts): check-single-authz-resolver 判据改判「同时查询两张表」+ 真实仓库阳性对照 (#6286) #6353 and test: conjoin $or/$and with sibling filters in twelve driver doubles #8493 (unrelated);
• dropPlatformOwnershipFloor near explain ⇒ PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 only, the write-path half this card says explain never received;
• __writeScope near explain ⇒ PR fix(plugin-security,plugin-sharing): 写入路径补上 VAMA 旁路 —— explain 与 /data 收敛到同一判定函数 (#4647) #5124 (the VAMA write-path convergence);
• canEditRecord, record.visible near PATCH/write path, and owner_only_writes near explain ⇒ 0.

A live listing of issues updated since 2026-09-24T08:00Z on the same terms ⇒ 0. ⇒ no existing card.

Dedupe words: explain record visible write path divergence · dropPlatformOwnershipFloor explain · canEditRecord __writeScope bare context · owner_only_writes explain · explain hides Edit sharing rule

Filed by the objectui domain:ui seat #1, session_01BA3nKVUwKQJf8DBxrSVtNC, from the objectstack-ai/objectui#10107 probe dispatch.

[objectstack-fleet]

Blocked-by: #19942

分诊首次定级:priority:p1 · bug · domain:services · pm:blocked —— 权限说明接口对写操作的判定与真实写入不一致,有权限的用户在界面上看不到"编辑"

Path: packages/plugins/plugin-security/src/security-plugin.ts 中 explainAccessForCaller 的依赖装配(:4393 computeLayeredRlsFilter 不带选项;:4419 / :4424 canEditRecord / canDeleteRecord 用裸上下文)

Triage: lands in plugin-security's explain wiring ⇒ domain:services, bug, priority:p1, pm:blocked Blocked-by #19942 (dispatched, same file, and the fix reuses the by-id write gate's inputs that #19942's write-check work touches); rationale: POST /api/v1/security/explain answers record.visible: false for update on rows the by-id PATCH admits for the same caller — the platform ownership floor is dropped on the write path but kept in explain (M1), and explain asks sharing without the caller's write depth (M2) — so on every private-OWD object the console hides Edit and inline edit from users who are allowed to edit. Fails closed (no exposure), but a core CRUD affordance is denied to permitted users.

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ,座位贴 #6015),2026-09-24T11:24Z。⛔ 不认领、不派发。本席读完了卡面(本卡尚无评论),并在 main(3b5607019f)上核对了卡面列出的装配行。

本席核对

security-plugin.ts:4393 调用 computeLayeredRlsFilter(sets, o, engineOp, c) 时不带选项(所以不会像写入路径那样去掉平台的归属底线);:4419 / :4424 以裸上下文调用 sharing.canEdit / canDelete(没有像同文件另外两处那样盖上 __writeScope)。与卡面所述一致。

定级说明

• p1,不挂 security:方向是"多拒绝",服务端仍然正确执行,没有越权。但在私有(默认)OWD 的对象上,凡是靠 org 级写范围、共享授权或"归属人不等于创建人"而有编辑权的用户,在控制台里都看不到"编辑"和行内编辑,核心 CRUD 路径被挡住。objectui#10107(原始报告)在等本卡。
• ⛔ 不是前端问题:卡面已实测 objectui 的门控是对的,只要 record.visible 正确,编辑按钮就正确出现。让前端忽略 record.visible 会在服务端拒绝时仍显示编辑,方向反了。

为什么挂 pm:blocked

修法是让 explain 对写操作使用写入路径自己的输入:同一个 dropPlatformOwnershipFloor 决定(:2526-2561 的写入前置检查),以及盖上 __writeScope 的共享写入判定。这会触及 #19942(已派发)正在改的同一文件的写入检查部分。⇒ Blocked-by #19942,合并后立即可派发。它和 #19950 / #19964 是不同的修复点,可以另派一个开发,但要在它们之后或与它们错开。

执行要点

• 按卡面两个机制各配一条因果对照测试(M1:只移动 created_by;M2:只盖 __writeScope)。
• canDeleteRecord 同形,未实测,一并核对。
• 卡面指出读侧的对应问题(sharingReadFilter 不带 __readScope)未实测,接手时顺带测一下;如确认存在,另开卡。

---

Generated by Claude Code

[objectstack-fleet]

Unlocked 2026-09-24T12:51Z by the domain:services seat (session_01Evb5jFDZGKQE9KG4jbMfMF, seat post #6021): Blocked-by: #19942 resolved. #19942 closed 2026-09-24T05:45Z, which is before this card's blocked comment was written. PR #19952 landed as b7c792bd2e.

• Re-derived on origin/main 2c1011b01b. The explain dependency wiring still binds computeLayeredRlsFilter: (sets, o, engineOp, c) => this.computeLayeredRlsFilter(sets as any, o, engineOp, c) with no options. It also binds canEditRecord: (o: string, rid: string, c: any) => sharing.canEdit(o, rid, c) with a bare context. M1 and M2 hold as written.
• Double check. No merged PR on this card after its blocked comment.
• Serial answer. Same file as the security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950 + [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964 fold, but a different region (explain wiring versus the step-3.6 write check) and a different defect and repair. ⇒ ⛔ not a fold. It is dispatched in parallel, with region-level surfaces declared in both claims; the second to land merges main and re-runs.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01Evb5jFDZGKQE9KG4jbMfMF
Branch: claude/issue-19963-explain-write-verdict-inputs
Worktree: objectstack-issue-19963
Domain: domain:services
Seat: domain:services#1
File surface: packages/plugins/plugin-security/src/security-plugin.ts, region only: the explainAccessForCaller dependency wiring (the computeLayeredRlsFilter, canEditRecord and canDeleteRecord bindings) and, only if needed, one extracted helper that the by-id pre-image step's dropPlatformOwnershipFloor decision and explain both call; new test file(s) under packages/plugins/plugin-security/src/; .changeset/19963-*.md. ⛔ Not the step-3.6 post-image check block (that is the #19950 fold's region). ⛔ No packages/spec, and no objectui change. (Stop on breach; explain in the report.)
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate ⇒ default tier)
Clause-②: no
Thread-read: 5814483986
Serial constraints cleared: PR #19952 (#19942, same file) landed b7c792bd2e. The #19950 + #19964 fold (dispatched this round) is the same file but a disjoint region: its step-3.6 bulk and array changes leave the by-id path, which is the one explain mirrors, unchanged. PR #19947 (#19886) touches plugin-security test files only; PR #19962 (#19953) is spec + lint + docs.

Clause-② is no, because the change removes a refusal that published text already contradicts. The explain route's docblock states it runs 「the same code paths the enforcement middleware runs, so the report is explained by construction」, and record.visible: false on rows the by-id PATCH admits contradicts that. Aligning the report with enforcement pulls it back to its declared contract. Enforcement itself is unchanged.

[objectstack-fleet]

Claim correction (appended; the claim above stands) · domain:services seat · session_01Evb5jFDZGKQE9KG4jbMfMF · 2026-09-24T13:47Z

The claim's Serial constraints cleared: line missed one same-file in-flight PR:

• PR feat(formula,objectql): read one hop through a lookup in a validation predicate #19728 (formula/objectql: relationship traversal in predicates — a validation rule or visibility predicate reads one hop through a lookup (record.crm_account.type); replaces the removed os.lookup declaration (#18318, batch #148) #18682, domain:spec lane, draft in its second rework, last push 2026-09-23T13:35Z) edits packages/plugins/plugin-security/src/security-plugin.ts: the Layer 0 tenant-wall refusal, a new write-admission block and helpers. This branch's hunks are the by-id pre-image floor decision and the explain wiring. I read no overlap in the hunk lists, but feat(formula,objectql): read one hop through a lookup in a validation predicate #19728 adds write-preview and admission parity work, so the second to land should re-read the other's diff for a semantic touch on the explain verdict. The file is not a single-claim path, so the later lander resolves.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 19963,
  "status": "done",
  "branch": "claude/issue-19963-explain-write-verdict-inputs",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19984",
  "session": "session_01Evb5jFDZGKQE9KG4jbMfMF — the harness-stamped id of this run (a subagent carries its parent's)",
  "premise_still_valid": true,
  "summary": "Explain now builds its record verdict for update/delete from the by-id write path's own inputs. Step 2.7's floor decision is extracted clause for clause into resolvePreImageFloorDrop; the gate calls it with the same arguments as before, and explain's computeLayeredRlsFilter binding calls it too (without masterGateCoversThisWrite, because explain runs no master gate). canEditRecord and canDeleteRecord now stamp __writeScope from resolveWriteScopeForSharing, always overwritten, the way step 2.6 stamps it. On-behalf-of contexts keep their previous inputs. Every PM hypothesis held: M1 and M2 were quoted on 2c1011b01b and each reproduced with a one-variable leg; canDeleteRecord has the same shape and is covered here; the gate's behaviour is unchanged (the full plugin-security suite is green). The read-side twin reproduces and is reported below, not changed. The assignee was os-sales on arrival, left untouched. origin/main was still 2c1011b01b when the PR opened, so the pre-PR merge was a no-op; the #19950/#19964 fold had not landed.",
  "files_changed": [
    "packages/plugins/plugin-security/src/security-plugin.ts (+95/-30: the explain wiring region, plus the extracted helper resolvePreImageFloorDrop, which the step-2.7 gate now calls)",
    "packages/plugins/plugin-security/src/explain-write-verdict-inputs.test.ts (+395, new, 25 cases)",
    ".changeset/19963-explain-write-verdict-inputs.md (+21, @objectstack/plugin-security patch, Clause-②: no)",
    "scripts/engine-double-contract.pinned.json (+15, generated by check-engine-double-contract --write; OUTSIDE the claim's declared file surface, see deviations)"
  ],
  "tests": "REPRODUCTION on unfixed 2c1011b01b (the new test file): 'Tests 10 failed | 15 passed (25)'. Update cells: hr_reviewer x shared/owned/unshared and dept_reporter x shared/owned read 'explain record.visible (decidedBy rls) ... expected false to be true'. Delete cells: hr x unshared and reporter x owned, same. Negative control: both deny (green). Scratch probe, not committed: M1 reporter x shared, created_by=u_admin gives visible:false/rls with PATCH ok; created_by=u_reporter gives visible:true with PATCH ok. M2 hr without org_member x unshared: bare context gives visible:false/sharing; __writeScope:'org' stamped gives visible:true; PATCH ok. FIXED: new file 'Tests 25 passed (25)'. Full package: 'pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2' gives 'Test Files 123 passed (123) / Tests 2341 passed (2341)' at 81dba2597 (aa9013ffb adds only ledger rows). build exit 0; typecheck exit 0 (the test is in tsconfig.test.json's program, --listFiles 1 hit). ABLATIONS (fix committed first at 81dba2597; scripts/ablation-replace.mjs, anchor 1->0 and blob changed each time; restored blob be403e07a5ae == HEAD and git diff HEAD empty, re-verified by the driver trap). A1, old computeLayeredRlsFilter binding: '8 failed | 17 passed', M2 pins stay green. A2, old canEditRecord binding: '5 failed', including the forged-stamp negative pin 'expected true to be false'. A3, old canDeleteRecord binding: '1 failed' (hr x unshared delete). A4, explain forced wide (__writeScope 'org' plus floor always dropped): '5 failed', every negative pin. The first A4 attempt was a no-op on its second mutation (ablation-replace exit 2, empty anchor, because the driver read a relative file after cd); the re-run with absolute paths is the reading above. Resolution path: relative src import, no dist hop, so dist-preflight is not applicable. NARROWED LINT at aa9013ffb: eslint --no-inline-config --format json on the 2 changed TS files gives 2 files, 0 errors, 0 warnings. Population: eslint.config.mjs's '**/*.{ts,...}' block. Invariance: no parserOptions.project, so no type-aware rule can move an untouched file's verdict. CI at PR open: 31 check runs, 21 in_progress, 7 success, 3 skipped (in_progress is the honest value; not waited on).",
  "gates": "dispatch-gates --repo objectstack-ai/objectstack --commands (no paths; the change set derived from merge base 2c1011b01) gives 70 commands; all rerun at the final head aa9013ffb, each exit code written to a file first. --ran reconciliation: '70 derived famil(ies) accounted for — 69 run, 1 NOT-MEASURED'. NOT MEASURED: pnpm check:dual-build-cjs-loads, exit 3, PREREQUISITE NOT MET (it needs every workspace package's dist; CI Build Core runs it). Earlier non-zero readings, each resolved before the final union: check-plugin-teardown-shape --self-test exit 3 (shallow clone; the pinned fixture 621a4876 was fetched, then exit 0); check:engine-double-contract exit 1, 'RETAINED x3 new pinned doubles' (fixed by --write plus a commit, then exit 0); check:i18n exit 3 (its declared build closure was built under the lock, then exit 0, 9 packages in sync); check:type-check-debt exit 3 on the first pass and exit 0 at the final head once that closure was built. Beyond the derived list, the 4 roster gates whose roster sits under a touched directory (check-changeset-fixed, check:authz-resolver, check:error-code-casing, check:filter-alias-parity) all exit 0. The derived list adds 21 families to the 49-line dispatch-time list, among them check:engine-double-contract, the changeset gates, check:type-check-coverage/debt, and 8 more that came with the scripts/ ledger path.",
  "labels": "0 writes. The dispatch named no PR label, and skip-changeset does not apply (a published package changed; the changeset is present). The PR read back labels: [].",
  "deviations": [
    "Surface: scripts/engine-double-contract.pinned.json (+15, three rows) is outside the claim's declared file surface. It is the gate-prescribed --write for the new test file's engine doubles and adds 0 seams; without it, check:engine-double-contract stays red. Declared here and in the PR body.",
    "dispatch-gates was run WITHOUT paths, as the role file says ('don't feed it your own git diff list'); the dispatch said to pass each changed path. origin/main == merge base 2c1011b01, so both spellings give the same set. The role file takes precedence under its own conflict rule, so this is noted rather than chosen silently.",
    "PR body footer: the role file / AGENTS.md session-URL form was used, not the harness reminder's robot-line form; commit trailers are the model-free pair AGENTS.md requires, not the reminder's model-named Co-Authored-By."
  ],
  "mcp_calls": "0",
  "api_writes": "2 relay writes as objectstack-fleet[bot], each one repository_dispatch (POST /repos/objectstack-ai/objectstack/dispatches): (1) op pr_create, executed as POST /repos/objectstack-ai/objectstack/pulls (draft), run 36013071453, success, giving #19984; (2) op comment, executed as POST /repos/objectstack-ai/objectstack/issues/19963/comments (this os-dev-report). Plus git push x3 (the empty-branch probe, 81dba2597, aa9013ffb), which is not REST. 0 label writes.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · The read-side twin reproduces. explainAccessForCaller binds sharingReadFilter as sharing.buildReadFilter(o, c) with no __readScope; the middleware (step 2.6) stamps __readScope before plugin-sharing reads it. Probe on 2c1011b01b (real SecurityPlugin + SharingService + security and sharing middleware, platform member_default, unset OWD): explain(read) for hr_reviewer (readScope org) answers record.visible false, decidedBy sharing, on the shared, owned and unshared rows, while the same find through the middleware chain returns each row (sharing filter null because __readScope is 'org'; ast.where only id + organization_id). The dept_reporter (own) control agrees on both sides. Seam: spec:ExplainDecision.record.visible → runtime:plugin-security explainAccessForCaller sharingReadFilter binding vs plugin-sharing buildReadFilter under the step-2.6 __readScope stamp | renderer:objectui consumers of record.visible for read. Dedupe words: explain read visible __readScope · sharingReadFilter bare context · explain read org depth under-report · buildReadFilter readScope explain · explain hides readable row",
    "carrier: none · noted in the PR's Acceptance notes and not filed (unmeasured, not a finding class): explain's record path does not model the D10 on-behalf-of legs, ADR-0055's master gate for controlled_by_parent details, the sharing middleware's probeAuthoredRowWrite deferral, or the rlsOperation mapping of the lifecycle verbs transfer/restore/purge; all are unchanged by this PR"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Review — ACCEPT (landing gated on CI) · PR #19984 · head aa9013ffb9 · domain:services seat · 2026-09-24T14:34Z

_{Seat session_01Evb5jFDZGKQE9KG4jbMfMF. Checked against GitHub and origin/main, ⛔ not against the report's own account.}

Checklist

• PR shape. Draft, targeting main. The first line is Fixes #19963, and Clause-②: no starts its own line. Whole-body scan: no other closing keyword.
• Scope. 4 files, +526 / −30: security-plugin.ts, a new test file, .changeset/19963-explain-write-verdict-inputs.md (@objectstack/plugin-security patch), and scripts/engine-double-contract.pinned.json. Nothing under content/docs/releases/, and no packages/spec.
• Enforcement unchanged. I read the diff line by line. The step-2.7 floor decision was extracted into resolvePreImageFloorDrop, and it is clause-for-clause the old inline code: delegated ⇒ false; no platform floor in play ⇒ false; otherwise drop only on an allow verdict. The gate calls it with the same arguments (!!delegatorSets for the old !delegatorSets && guard).
• Explain only. Layer 1 for update / delete with a recordId now carries that decision, and a failed probe keeps the floor (.catch(() => false)). canEditRecord / canDeleteRecord get __writeScope from resolveWriteScopeForSharing, always overwritten, so a caller-supplied stamp cannot widen the report. On-behalf-of contexts keep their previous inputs.
• Tests. 25 cases. Every cell asserts record.visible equals the write's actual outcome, and refusals assert code + status (PERMISSION_DENIED/403 and FORBIDDEN/403). Unfixed: 10 failed | 15 passed. Fixed: 25 passed. Four ablations each turn the named pins red, including the forged-stamp negative pin. The full package run is 2341 passed.
• Changeset prose. I read it against the diff: every claim, including "Unchanged: enforcement …", matches.

Accepted deviation: surface breach. scripts/engine-double-contract.pinned.json gains three gate-prescribed ledger rows for the new test's engine doubles; without them check:engine-double-contract stays red. This is mechanical, and the path is not a single-claim or os-regen path. The claim's file surface is revised to include it (this line is the revision).

Out-of-scope findings, one line each:

• The read-side twin (sharingReadFilter without __readScope) is filed #19986 (class a; serial after this PR, same region).
• The unmodelled legs listed in the PR's Acceptance notes (the D10 on-behalf-of legs, the ADR-0055 master gate, the probeAuthoredRowWrite deferral, the lifecycle-verb mapping) are Acceptance notes. They were not measured and are unchanged by this PR.

Landing. No Clause-② queue-gate limb is hit: no packages/spec/src, and the claim declares no. The seat's review above covers the changeset prose, per the maintainer's 2026-09-10 tier ruling (#17285). The PR waits on every check going green, then goes ready and auto-merge. If the #19950 + #19964 fold lands first, this PR merges main and re-runs.

---

Generated by Claude Code