fix(spec): state the RLS using / check texts as the write gate enforces them

[objectstack-fleet]

Fixes #19967
Clause-②: no

Text only. No schema shape, accepted value or runtime behaviour moves. Every sentence below was re-measured against the code on origin/main at 0d3ec47137, where PR #19962 (b5853da1ca), PR #19988 (009da14713), PR #20012 (44639665ee, #19989) and PR #20167 (b276d4463f) are all merged. Each git merge-base --is-ancestor probe returned exit 0.

What main enforces (the measurement the texts now state)

• Write check selection, per operation. writeCheckPolicies (packages/plugins/plugin-security/src/security-plugin.ts:890-899) returns the policies that declare check when any applicable policy does. Otherwise it returns every applicable policy with a using, and keeps the platform ownership floor only where the write's row gate kept it. compileFilter (rls-compiler.ts:600-602) reads check for a policy that declares one and using for the rest, then OR-combines (:676).

• A USING-only insert policy's using is the insert check when no applicable policy declares check. Pinned by rls-check-defaults-to-using.test.ts, case "an insert-class USING-only policy gates INSERT the same way", which is green on this head.

• A check-only update policy is legal and enforced. The schema accepts it (rls.zod.ts, the at-least-one rule). The row gate derives the write scope from select when no write-class using applies (security-plugin.ts:7018), and the post-image check judges the written rows. Pinned by check-only-write-scope.test.ts, which is green. The showcase's invoice_owner_immutable is one such policy.

• A non-blank check on select / delete is refused (rls.zod.ts, the superRefine at the check path, from PR feat(spec)!: refuse a check on a select / delete row-level security policy #20167).

• OR-combination. On reads, and on the rows an update or delete may target, the applicable policies' using clauses OR-combine (compileFilter). On the written rows, the check is chosen first and then OR-combined. So "most permissive wins" is true on reads and false as a statement about writes.

• Post-image scope: every insert and update shape. The seam is installed for every insert and for every update (security-plugin.ts:3191, :3261, :3508). The engine runs it:

  • on each live row of an insert, after beforeInsert (packages/objectql/src/engine.ts:12470);
  • on the by-id row merged with the final payload, after beforeUpdate (:14085, PR fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012);
  • on each matched row of a multi: true update (:14345, PR fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988).

  The by-id update is also judged in the middleware on the change set as sent (security-plugin.ts:3116). Pinned by rls-check-multi-row-writes.test.ts, rls-check-by-id-update-post-hook.test.ts and insert-check-post-image.test.ts, all green on this head.

Sites, old text, new text, and the code that makes the new text true

Site	Old text	New text	True because
rls.zod.ts check describe	"matched against the new row of a single-record INSERT or a by-id UPDATE ...; an array insert and a multi: true update are not post-image checked."	"judged on every row an insert or an update writes ...: each row of an insert, an array insert included, as its beforeInsert hooks leave it, and each row an update changes, by id or multi: true, as the prior row merged with the final payload after its beforeUpdate hooks. One failing row refuses the whole write. A by-id update is also judged, before its hooks, on the prior row merged with the change set as sent."	engine.ts:12470, :14085, :14345; security-plugin.ts:3116
rls.zod.ts check TSDoc	"Validation of the new row of a single-record INSERT or a by-id UPDATE. An array insert and a multi: true update are not post-image checked."	Every row an insert or update writes, with the per-shape image. It also names the engine-filled values that are not on an insert's judged image (autonumber, a secret field's stored reference, an absent tenant column).	the same lines; the engine's closed list after the insert seam (engine.ts, the comment above :12470)
rls.zod.ts check TSDoc, floor	"takes part only where the by-id pre-image gate kept it"	"only where the write's own row gate kept it"	computeWriteCheckFilter: a multi: true update has no by-id gate and keeps the floor unless the OWD yields (platformFloorYieldsToObjectWriteModel)
rls.zod.ts using describe	"Filter condition for SELECT/UPDATE/DELETE ... Optional for INSERT-only policies."	"Row predicate ...: the rows a select policy lets a caller read, and the existing rows an update or delete policy lets a caller change or remove. On an insert or an update, when no applicable policy for that operation declares check, each applicable policy's using also stands in as its check on every row written ...; on an insert policy that is its only effect. ... Needed on a select or delete policy (a check there is refused); optional on an insert, update or all policy that declares check."	writeCheckPolicies:896; getApplicablePolicies:846; the check refusal
rls.zod.ts using TSDoc	"For INSERT-only policies, USING is not required (only CHECK is needed). For SELECT/UPDATE/DELETE operations, USING is required."	A per-operation list. update does not require using: a check-only update policy is accepted and enforced, and its target rows come from the other update / all using or from select. An insert policy's using filters nothing, but it is the insert check when none is declared.	security-plugin.ts:7018; check-only-write-scope.test.ts
rls.zod.ts superRefine message	"... For SELECT/UPDATE/DELETE operations, provide "using". For INSERT operations, provide "check"."	The same head. Then: select / delete take "using"; insert takes "check", or a "using" alone as that check when no applicable insert policy declares one; update / all take either or both.	the schema accepts each prescription (pinned below)
rls.zod.ts schema TSDoc	"combined with OR logic (union of results)"	OR on reads; on writes, the per-operation choice (see check)	compileFilter; writeCheckPolicies
rls.zod.ts priority TSDoc	"Applicable policies OR-combine (... the doc above RLSCompiler.compileFilter and this schema's own former describe both say most-permissive-wins)"	No outcome depends on an order: OR on reads; on writes, the check is chosen per operation and then OR-combined	the same
rls.zod.ts overview, "Default Deny"	"If no policy matches, access is denied"	Default deny among the policies that apply. When no policy applies, the policies restrict nothing (the tenant wall still applies).	compileFilter:656 (applicable === 0 returns null, no filter); content/docs/permissions/rls.mdx callout
migrations/registry.ts --from 16 prose (and regenerated docs/protocol-upgrade-guide.md)	"applicable policies OR-combine (most permissive wins)"	"no outcome depends on an order: applicable policies OR-combine on reads, and a write's check is chosen once per operation across the applicable policies, then OR-combined"	the same
liveness/permission.json check / using evidence	compileFilter "(policy as { check?: string }).check ?? policy.using" (the expression is gone)	security-plugin.ts#writeCheckPolicies plus rls-compiler.ts#compileFilter, with the live expression	check:liveness resolves both anchors (green)
security-plugin.ts writeCheckPolicies docblock	"The published contract is RowLevelSecurityPolicySchema.check: "defaults to USING clause if not specified"."	It points at RowLevelSecurityPolicySchema.check without quoting it, so it cannot go stale. PostgreSQL's per-policy rule is named as the starting point.	the describe itself
rls-check-defaults-to-using.test.ts header	"A policy that declares no check holds the write post-image to its using, which is what RowLevelSecurityPolicySchema.check publishes: "defaults to USING clause if not specified"."	When no applicable policy declares check, each using stands in. The choice is per operation, not per policy.	writeCheckPolicies
content/docs/permissions/authorization.mdx:108-109	"Multiple row policies for the same object/operation OR-combine"	They OR-combine their using on reads and on the rows a write may target. The written-row check is chosen per operation first. Links the fail-closed contract.	the same

In-place fixes beyond the claim's file surface (same defect class: the same stale sentences)

The dispatch asked for a grep for other copies of the old sentences. These hits are not governed and not pending changesets, so they are fixed here. File-surface supplement for the claim: content/docs/permissions/rls.mdx, content/docs/protocol/objectql/security.mdx and packages/spec/src/conversions/registry.ts (TSDoc only). The two changesets below are also outside it.

• content/docs/permissions/rls.mdx:63: "after a single-record insert or a by-id update; an array insert and a multi: true update are not checked" now says every row an insert or update writes.
• content/docs/protocol/objectql/security.mdx:144: the same parenthetical. using is no longer "for SELECT/UPDATE/DELETE" only.
• packages/spec/src/conversions/registry.ts: the permission-rls-priority-removed TSDoc said "most permissive wins". Its summary (which feeds spec-changes.json) is unchanged and not false.
• packages/spec/src/security/rls.test.ts: the priority test comment said "(most permissive wins)".

Pin sweep for the superRefine message

① The repo-wide grep for At least one of and provide "using" finds pins only in packages/spec/src/security/rls.test.ts: toContain('At least one of') and its negation. Both still hold, because the head is unchanged. No other package, doc or translation carries the message.

② New load-bearing pins, in the RowLevelSecurityPolicySchema — the "at least one" refusal block of rls.test.ts. For each of the five operations they assert the refusal's code (custom), path ([]) and head, that every operation is named, and that the false sentence is absent. They then prove each prescription against the schema itself: select / delete + using, insert + check, insert + using alone, and update / all with check only, using only, and both. All parse.

Pending release notes corrected (DELIBERATE CORRECTION: check-empty-changeset is red by design)

• .changeset/19953-rls-check-default-composition-text.md (from PR fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962). It said: "The check runs on the new row of a single-record insert and of a by-id update. An array insert and a multi: true update are not post-image checked; those are tracked in [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964 and security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950, and the texts now say so". That would ship false. fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988 and fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012 land in the same release, and this PR changes the texts it says "now say so". The rewrite dates the old scope to when that change was written, and states the release's scope.
• .changeset/rls-check-defaults-to-using.md (from PR fix(plugin-security): a USING-only RLS policy holds INSERT and UPDATE rows to its using #19952). It said: "RowLevelSecurityPolicySchema.check reads "defaults to USING clause if not specified"". The describe no longer reads that in the release this note ships in (PR fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962). Changed to "read ... (it now states the default per operation across the applicable policies, spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953)". The triage on [finding] After PR #19962 rewrites the RLS check describe, three texts still quote the old "defaults to USING clause if not specified" contract, and the using text never says it is the insert check when no check is declared #19967 raised this note for the dev to judge.

The gate's remedy is to say so here and get it confirmed. Restoring either note from base would put the false sentence back.

Reported only, not edited

• Governed (Tier H):
  • docs/adr/0066-unified-authorization-model.md:93: "Multiple row policies for the same object/operation are OR-combined". This is the ADR sentence that authorization.mdx paraphrases, and it has the same false-for-writes reading.
  • skills/objectstack-data/rules/security.md:72-75: calls using the "read filter" and check the "write filter", and does not state the stand-in check.
  • docs/adr/0095-authz-kernel-tenant-layer-and-posture-ladder.md:79-81: about the read filter, and not false.
• Release-owned (never edited in a code PR): packages/spec/CHANGELOG.md:46934, :73373 and packages/plugins/plugin-security/CHANGELOG.md:6610, :10225. These say "(the schema's own describe says most-permissive-wins)". That was true of the describe when they shipped.
• packages/spec/spec-changes.json:79, :971: the generated summary "policies OR-combine". It is shorthand and not false. It is regenerated from the conversion registry, which this PR leaves as is.

Published surface

• @objectstack/spec: patch. It ships src/**/*.zod.ts, dist, liveness and the --from 16 prose.
• @objectstack/plugin-security: no changeset. The two edits are a comment in a non-exported function and a test header. Measured: tsup strips in-body comments. A positive control in packages/objectql/dist/index.js shows the code line postHookWriteImageCheck.honoured = true present (1 hit) and the comment above it, "INSERT POST-IMAGE seam", absent (0 hits). writeCheckPolicies is not exported, so no .d.ts carries its docblock.

Verification

Every reading below was taken on head e2bd8f3680, the final commit, with a clean tree.

• Gate union. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived the list. --ran reconciles it: "116 derived famil(ies) accounted for — 112 run, 4 NOT-MEASURED". The 116 includes 2 families the derivation added after the regeneration commit (pnpm --filter @objectstack/spec run check:generated and pnpm check:quick-reference-counts). Both were run: exit 0.

  • 111 green.
  • 1 red by design: node scripts/check-empty-changeset.mjs --base origin/main exits 1 with the DELIBERATE CORRECTION class, for the two notes named above.
  • NOT MEASURED, each one a PREREQUISITE NOT MET (exit 3):
    • check:skill-examples needs a built @objectstack/client-react (a 36-package closure);
    • check:dual-build-cjs-loads needs a full pnpm build;
    • check:i18n needs the built CLI closure;
    • check:type-check-debt needs a whole-workspace build.

• @objectstack/spec build: exit 0, DTS included. check:generated: 2 of 15 stale (docs/protocol-upgrade-guide.md, content/docs/references/**). Regenerated with exactly gen:upgrade-guide && gen:docs, then "All 15 generated artifacts are up to date".

• @objectstack/spec tests: vitest run --project local --maxWorkers=2: "Test Files 547 passed (547) · Tests 16086 passed | 2 todo".

• @objectstack/plugin-security tests: vitest run --maxWorkers=2: "Test Files 139 passed (139) · Tests 2839 passed (2839)". This includes the semantics pins cited above: rls-check-defaults-to-using (22 cases), check-only-write-scope (21), rls-check-multi-row-writes (32), rls-check-by-id-update-post-hook (24) and insert-check-post-image (25), all green.

• @objectstack/plugin-security typecheck: exit 0, test layer included ("check:test-typecheck: OK").

• @objectstack/spec typecheck: declared narrowing. The full pnpm --filter @objectstack/spec typecheck never got a turn on the shared verify lock in about 40 minutes of queueing: 8 attempts, each exit 99. Its three legs are covered as follows:

  • the src program: the build's DTS pass compiles the entry closure, which contains rls.zod.ts, migrations/registry.ts and conversions/registry.ts;
  • the test program: check:test-typecheck is green inside check:generated on this head, and tsconfig.test.json includes src/**/*.test.ts;
  • check:scripts-typecheck: no spec script is touched.

  CI's TypeScript Type Check runs the full command.

• eslint, a proven narrowing:

  • ① Population: eslint.config.mjs lints **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} minus build output, which contains all 6 changed .ts files.
  • ② pnpm exec eslint --no-inline-config --format json over those 6 files reports 6 files, 0 errors, 0 warnings, exit 0.
  • ③ No config object sets parserOptions.project, so no rule is type-aware, and this diff cannot move a verdict on an untouched file.

• Control bytes: check:nul-bytes is green. The self-scan grep -naP for C0 control characters and DEL over the changed files exits 1 with no match.

Acceptance notes

• Whitespace-only check: the schema and the runtime disagree (observation, not filed; no public-door measurement, no named producer). The at-least-one rule tests !data.check, so check: ' ' satisfies it. The runtime and the select / delete refusal read a blank clause as absent (policyDeclaresClause). So a policy with only a whitespace check parses and is inert. The using describe's "needed on a select or delete policy" is worded as the runtime reads it.
• @objectstack/lint rls-predicate-* messages understate the scope (packages/lint/src/validate-rls-predicate-enforceability.ts:272, :318, :943, :969). They say "the single-record INSERT check" and "every single-record insert and by-id update ... fails". Since PR fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988 and PR fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012 this is true but narrow: array inserts and multi: true updates are refused too. These are not false, and they are outside this card's file surface. Carrier: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/plugin-security, @objectstack/spec, touching 1 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/security-plugin.ts, packages/spec/liveness/permission.json, packages/spec/src/conversions/registry.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/objectql/security.mdx (via RowLevelSecurityPolicySchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v13.mdx (via RowLevelSecurityPolicySchema (symbol, a top-level const))
• content/docs/releases/v17/17-0.mdx (via RowLevelSecurityPolicySchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/security-plugin.ts, packages/spec/liveness/permission.json, packages/spec/src/conversions/registry.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 139 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 17bd31877109b7cc692e7e54c4fe39f82a5c32d5 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8b5999e053334a30d46c0f3223a1672f003b5727 — the merge of head 7bfc993cb58342b79f4bf4990e4f9e77189bad2c into base 17bd31877109b7cc692e7e54c4fe39f82a5c32d5, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8b5999e053334a30d46c0f3223a1672f003b5727 && git checkout 8b5999e053334a30d46c0f3223a1672f003b5727
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 17bd31877109b7cc692e7e54c4fe39f82a5c32d5 7bfc993cb58342b79f4bf4990e4f9e77189bad2c && git checkout -B drift-repro 17bd31877109b7cc692e7e54c4fe39f82a5c32d5 && git merge --no-ff 7bfc993cb58342b79f4bf4990e4f9e77189bad2c

node scripts/docs-audit/affected-docs.mjs --json 17bd31877109b7cc692e7e54c4fe39f82a5c32d5

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 17bd31877109b7cc692e7e54c4fe39f82a5c32d5 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: 84/84 CONTRACT_REVIEW_TIER
Head-sha: e2bd8f36806b05dcf16d4ada01aa5d02bc98233d

① Derived judgments

1. Head unmoved (e2bd8f3680); fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962/fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988/fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012/feat(spec)!: refuse a check on a select / delete row-level security policy #20167 shas are ancestors (exit 0). Sentence by sentence, at head:

• check judges every row an insert/update writes, arrays and multi: true included, one failing row refuses all: TRUE — seam security-plugin.ts:3191 (insert), :3261 (every update); run at engine.ts:12470 (each live row after beforeInsert), :14085 (by-id, prior + payload after hooks), :14345 (each matched row); denyCheck() on the first failing row (:3170-3176).
• by-id also judged before hooks on prior row + change set as sent: TRUE — :3116-3209.
• check-only update legal and enforced: TRUE — the only check refusal is on select/delete (rls.zod.ts:569-572); computeWriteCheckFilter → writeCheckPolicies:894; target rows derive from select when no write-class using applies (:7018-7027).
• insert using is the check when none declares check: TRUE — writeCheckPolicies:896-898; rls-compiler.ts:600-602 reads using on the check pass.
• non-blank check on select/delete refused: TRUE — rls.zod.ts:569-572 (trim() !== '').
• OR on reads; writes chosen per operation then OR: TRUE — compileFilter:676; selection is a filter, order-free.
• using describe/TSDoc, priority and schema TSDoc, --from 16 prose and guide, conversions/registry.ts:1919, permission.json (both anchors resolve; liveness green), writeCheckPolicies docblock, test header, authorization.mdx, rls.mdx:63, objectql/security.mdx:144: TRUE. Minor: the insert engine-filled list omits normalizeMultiValueFields (closed list above :12470); not false.

2. Default Deny (SECURITY). Trace: getApplicablePolicies (enabled/object/positions/operation) empty → computeLayeredRlsFilter never compiles (non-empty guard :7044) → Layer 1 null; computeWriteCheckFilter returns null at withCheck.length === 0 (:7314); RLS_DENY_FILTER arms only when applicable policies exist and all drop (rls-compiler.ts:657-671, :7085). No default-deny switch exists (RLSConfig removed). The tenant wall AND-composes independently (:7100). The new sentence is TRUE in every configuration traced; the old "access is denied" was FALSE in the dangerous direction (a caller outside every policy's positions is open). Incomplete only in the safe direction (reader over-estimates exposure): (a) an update/delete with no write-class using is still bounded by the caller's select policies (:7018), which the schema's applicability definition does not count as applying to the operation; (b) the OWD sharing read filter (:5193) and the platform floor also narrow; (c) viewAllRecords/modifyAllRecords skip Layer 1 (:6876). The PR's using TSDoc states (a); rls.mdx states the rest. Not blocking; follow-up clause: "for an update or delete, the caller's select policies bound the target rows when no write-class using applies".
3. superRefine message: every prescription parses (only two refinements exist). Pins rls.test.ts:744-796 assert head, all five operation names, absence of the old sentence, the four prescription phrases, and parse each shape (select/delete+using, insert+check, insert+using, update/all ×3); a regression reddens not.toContain and each toContain. Existing :592/:606 pins hold.
4. DELIBERATE CORRECTION, confirmed; the Check Changeset log names exactly these two M rows, rule 1 green.

• .changeset/19953-rls-check-default-composition-text.md. Old: "The check runs on the new row of a single-record insert and of a by-id update. An array insert and a multi: true update are not post-image checked; those are tracked in [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964 and security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950, and the texts now say so" — would ship FALSE: 19950-rls-check-multi-row-writes.md and 19989-by-id-update-post-hook-check.md are pending in the same release. New: "When this text change was written, the check ran on … only, and the texts said so. The same release extends it: every row of an array insert and of a multi: true update is judged ([finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964, security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950), and a by-id update is also judged on the row its beforeUpdate hooks leave (security: a by-id UPDATE's row-level check is judged on the pre-hook change set, so a beforeUpdate stamp that rewrites a checked field (e.g. the organization derived from a re-pointed parent) is stored unjudged — the tracker #16790 now answers 404 #19989). The texts now state that every row an insert or an update writes is judged ([finding] After PR #19962 rewrites the RLS check describe, three texts still quote the old "defaults to USING clause if not specified" contract, and the using text never says it is the insert check when no check is declared #19967)" — TRUE. Every other sentence (composition, applicability, select/delete check never evaluated, spec and lint bullets; "single-record" there describes the lint wording) — TRUE.
• .changeset/rls-check-defaults-to-using.md. Old: "RowLevelSecurityPolicySchema.check reads "defaults to USING clause if not specified"" — FALSE at head (0 hits on main and head). New: "read "defaults to USING clause if not specified" (it now states the default per operation across the applicable policies, spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953)" — TRUE. Every other sentence (BREAKING/minor, adr-0087 marker, four refused-write bullets, five unchanged bullets incl. modifyAllRecords bypass :7284) — TRUE.

5. .changeset/19967-rls-using-check-texts.md: every sentence TRUE; spec: patch right (shipped text); no plugin-security note is right (writeCheckPolicies unexported :890; test unshipped). Loose but not false: the overview never said "most permissive wins", only unqualified OR.
6. rls.zod.ts with comments and strings stripped differs from main only in the message literal; generated pages and guide mirror their sources verbatim; no governed path (Governed guard green). CI at poll: Build Core, Dogfood, Temporal, Type Check source/consumer/debt, liveness, doc links green; Lint & Repo Gates, Test Core 1/2/3/5/6, Type Check workspace in progress; only Check Changeset red, by design.

② Semver level

Clause-②: no correct: accept set unchanged (schema tokens identical; the superRefine message is refusal prose, not a rule); @objectstack/spec patch; nothing else publishes. No BREAKING banner or ADR-0087 marker owed.

③ Boundary flags

• ADR-0066:93 "OR-combined" as a write statement — governed Tier H, untouched, false for writes; the seat files the card.
• skills/objectstack-data/rules/security.md:72-75 read/write-filter wording, no stand-in rule — governed, untouched; same card.
• ADR-0095:79-81 — read-side, not false; no action.
• Lint rls-predicate-* "single-record" (validate-rls-predicate-enforceability.ts:272,318,943,969) — true but narrow since fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988/fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012; out of surface, note only.
• Whitespace-only check parses and is inert — real, no reach; note stands (a whitespace using on a select policy instead fails closed).
• Released CHANGELOG entries — release-owned, rightly untouched.
• File-surface supplement (rls.mdx, objectql/security.mdx, conversions/registry.ts TSDoc) — same stale sentences, text-only, seat-accepted.
• Default-deny incompleteness (①.2) — safe direction; one-line follow-up candidate.

Implemented-by: claude/issue-19967-rls-using-check-texts
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: PASS

[objectstack-fleet]

Contract review

Served-tier: 78/78 CONTRACT_REVIEW_TIER
Head-sha: 7bfc993cb58342b79f4bf4990e4f9e77189bad2c

① Derived judgments

1. Delta. PR re-read: head unmoved at 7bfc993cb5. git diff e2bd8f3680 7bfc993cb5 --stat is exactly packages/spec/src/security/rls.zod.ts | 5 +++--. Old: "OperationContext.postHookWriteImageCheck seam (plugin-security: the insert-side RLS check post-image is the raw caller payload evaluated before beforeInsert, so a field a hook stamps can never satisfy an insert check — the caller must send the value the hook will overwrite anyway #16608, security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950, [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964, security: a by-id UPDATE's row-level check is judged on the pre-hook change set, so a beforeUpdate stamp that rewrites a checked field (e.g. the organization derived from a re-pointed parent) is stored unjudged — the tracker #16790 now answers 404 #19989):". New: "OperationContext.postHookWriteImageCheck seam (introduced for inserts by commit a016f08, whose original card no longer resolves; extended by security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950, [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964 and security: a by-id UPDATE's row-level check is judged on the pre-hook change set, so a beforeUpdate stamp that rewrites a checked field (e.g. the organization derived from a re-pointed parent) is stored unjudged — the tracker #16790 now answers 404 #19989):". Anchor: git log -S postHookWriteImageCheck --oneline origin/main -- packages/objectql lists 44639665ee, 1f05ea4fb2, 009da14713, a016f08b8a; the oldest, a016f08b8a (PR fix(plugin-security)!: evaluate the insert-side RLS check on the row that will be stored, after beforeInsert #16805, "evaluate the insert-side RLS check on the row that will be stored, after beforeInsert"), adds postHookWriteImageCheck?: PostHookWriteImageCheck to OperationContext and the insert() run; it is on origin/main and the 10-hex prefix is unique. Sentence TRUE: plugin-security: the insert-side RLS check post-image is the raw caller payload evaluated before beforeInsert, so a field a hook stamps can never satisfy an insert check — the caller must send the value the hook will overwrite anyway #16608 answers 404; security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950 and [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964 are closed issues (closed by PR fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988, 009da14713: array insert and multi: true), security: a by-id UPDATE's row-level check is judged on the pre-hook change set, so a beforeUpdate stamp that rewrites a checked field (e.g. the organization derived from a re-pointed parent) is stored unjudged — the tracker #16790 now answers 404 #19989 closed by PR fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012 (44639665ee: by-id post-hook) — the cards under which the seam was extended. No replacement number guessed. Citation gate run in a throwaway worktree at head (--base origin/main, board probed): 80 citations across 38 files, 78 resolve, 2 cross-repo-unjudged, exit 0. CI Lint & Repo Gates (its carrier, lint.yml:4971) green at this head.
2. Code unchanged. rls.zod.ts at head vs origin/main with comments and string literals stripped: one hunk, the superRefine message literal (five concatenated literals). main has not touched rls.zod.ts since the merge base 0d3ec47137.
3. DELIBERATE CORRECTION at THIS head. git diff e2bd8f3680 7bfc993cb5 -- .changeset/ is empty; git diff 0d3ec47137 origin/main on both notes is empty. Check Changeset log at this head names exactly .changeset/19953-rls-check-default-composition-text.md and .changeset/rls-check-defaults-to-using.md as M rows; rule 1 green.
   • 19953-rls-check-default-composition-text.md. New: "When this text change was written, the check ran on the new row of a single-record insert and of a by-id update only, and the texts said so. The same release extends it: every row of an array insert and of a multi: true update is judged ([finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964, security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950), and a by-id update is also judged on the row its beforeUpdate hooks leave (security: a by-id UPDATE's row-level check is judged on the pre-hook change set, so a beforeUpdate stamp that rewrites a checked field (e.g. the organization derived from a re-pointed parent) is stored unjudged — the tracker #16790 now answers 404 #19989). The texts now state that every row an insert or an update writes is judged ([finding] After PR #19962 rewrites the RLS check describe, three texts still quote the old "defaults to USING clause if not specified" contract, and the using text never says it is the insert check when no check is declared #19967)." TRUE at head: engine.ts runs the seam at :12470 (each live insert row), :14081 (by-id, post-hook), :14340 (each matched row); 009da14713 and 44639665ee are ancestors of origin/main; 19950-rls-check-multi-row-writes.md and 19989-by-id-update-post-hook-check.md are still pending on main, so "the same release" holds. Old ("An array insert and a multi: true update are not post-image checked; those are tracked in [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964 and security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950") FALSE if kept.
   • rls-check-defaults-to-using.md. New: "RowLevelSecurityPolicySchema.check read "defaults to USING clause if not specified" (it now states the default per operation across the applicable policies, spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953)". TRUE: git grep 'defaults to USING clause' at head hits only the two notes; the head describe reads "The default to using is decided per operation across the applicable policies, not per policy"; spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953 resolves. Old ("reads ...") FALSE at head and on main.
   • main since the merge base: 12 commits, none touching security-plugin.ts, rls-compiler.ts, engine.ts or rls.zod.ts. 4d7e740d3b (fix(formula)!: refuse comparands that are not one value at the CEL lowering and the write-check evaluator #20259, note 19886-one-value-comparand-refused.md) narrows the CEL lowering in packages/formula only: more predicates are refused, and no sentence in either note or in the PR's texts becomes false ("does not lower fails closed" was already the rule). git merge-tree origin/main head: clean.
4. Other red checks: none. At poll: 27 success, 2 skipped (Console Pin Gate; Packed-tarball smoke, opt-in), Check Changeset red by design, 3 in progress (Test Core 3/6, 6/6; Type Check workspace) on source identical to e2bd8f3680, where those families ran green.

② Semver level

readClause2Line on the live body: kind declared, value no, arm null, line "Clause-②: no". Correct: the accept set is unchanged (stripped schema identical to main except refusal prose); @objectstack/spec patch in 19967-rls-using-check-texts.md fits shipped text (src/**/*.zod.ts, liveness, --from 16 prose); writeCheckPolicies is unexported, so no plugin-security note is owed. No BREAKING banner or ADR-0087 marker owed.

③ Boundary flags

• permission.json #13003 (21 sites, 404 today): 21 on main too; the PR's two note edits carry the pre-existing "RE-ANCHORED ([worklist] Migrate liveness line citations to symbol anchors — census: 117-173 of 298 live line-cited pairs fail key-proximity at line granularity today #13003)" text forward and add only #19967 and #19952; the gate's surfaces are packages/**/src/**/*.ts(x) and content/docs/releases/**, so JSON is outside it. Not this PR's defect.
• PR body, Verification: "taken on head e2bd8f3680, the final commit" is no longer the final commit; the readings hold (the later commit is one TSDoc comment). Body-only; one-line fix: name 7bfc993cb5 as head and e2bd8f3680 as the measured commit.
• #16608 still cited 6 times in engine.ts and security-plugin.ts sources (6 on main), on lines this PR did not edit; the diff-scoped gate does not judge them. Not this PR's defect.
• rls-check-defaults-to-using.md still cites #16790 and #16805 (both 404 via the API today) on lines this PR did not edit; .changeset/ is outside the gate. Pre-existing.
• Acceptance notes (whitespace-only check; lint rls-predicate-* "single-record" wording) unchanged since e2bd8f3680; still true, still note-only.
• Neither #16608 nor a016f08b8a appears in content/docs/references/** or the upgrade guide at either head: the TSDoc change made no generated artifact stale.

Implemented-by: claude/issue-19967-rls-using-check-texts
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: PASS