fix(plugin-security)!: on the write doors, a row the caller cannot read answers what a nonexistent id answers

[objectstack-fleet]

Fixes #21771
Clause-②: no (narrowing)

What this changes

On the write doors, a row the caller cannot read now answers exactly what a nonexistent id answers, for every principal class. This is ruling A on #21771, record 5985885287.

The by-id write pre-image check (security-plugin.ts, middleware step 2.7) now asks a question before "may you write this row?": can you read it? It asks this for the by-id update or delete the caller addressed. The question is the read door's own: a caller-context by-id read through the engine, so every data middleware's read visibility counts. That includes the parent-derived read gates of the attachment and comment kits. A row that read does not return is answered by the read door's not-found producer (recordNotFoundError from @objectstack/core): 404 RECORD_NOT_FOUND, the same body a nonexistent id gets. A caller who can read the row but may not write it keeps its 403.

Before this change, the read question was only implicit inside the write-class re-read. A principal that no write-class row filter binds was never asked it. Such a principal got a later gate's 403 for a hidden row and a 404 for a missing one.

Decisions, from the seat verdict 5986522256:

• Q1 → A. A by-id write to a row the caller cannot read answers not-found even when that caller's write gates would admit it. This is the narrowing declared above. The claim line "no change to who may write" is withdrawn.
• Q2 → A. Only the write the caller addressed is asked the new question. By-id writes the platform issues under the caller's context keep their answer exactly: the engine's cascade delete of a dependent row, a hook's ctx.api write, and the referential clear of a lookup. The tree had no signal that marks the addressed write, so this PR adds one owned by plugin-security: an async scope its middleware opens around the rest of the chain (engineOperationScope). A by-id write that starts inside another engine operation reads as nested. The FK clear is excluded by its existing server-derived marker. No engine source is edited. The engine's not-found gate order was measured and is not part of the split.
• Q3 → A. One PR. security/explain models the same answer. The explain parity suites stay equal.

Binding constraints, as built:

1. Only absence is "cannot read". A store fault propagates as raised. A read-time policy refusal (a declared 4xx) keeps the answer the write had before. This is one shared classifier, absentUnderCallerRead, used by the write path and by explain.
2. By-id versus predicate comes from the engine's own dispatch predicates, resolveEngineUpdateDispatch and resolveEngineDeleteDispatch, in addressedByIdWriteId. It is never a second id extractor.
3. The server-derived FK-clear write is excluded.
4. The answer comes from the read door's producer. There is no new error code and no hand-built body.

Explain. For an update or delete of a record the explained principal cannot read, the record-grained verdict is now the missing-record shape: visible: false, with no decider. It is reached past the capability and object-CRUD gates, as enforcement reaches it. The question goes through a new optional dependency, recordAbsentToCaller, which runs the same caller-context read and the same classifier.

ADR-0087. The changeset's FROM → TO is a prescription a consumer acts on. With it in the body, the registration gate left registered as the only honest disposition. So this PR adds one D3 semantic entry in step 18, 18.by-id-write-unreadable-row-not-found, generated with gen:migration-registry. check:generated is clean. This is the conditional spec declaration on #6017. No Zod schema, contract docblock or export moves.

Client census (before any code, as the ruling ordered)

The question: does any shipped client, or any test in this repo, read a by-id write's 403 as "the row exists but you have no access" in a way the move would break?

• packages/client (client.data.update / client.data.delete envelope cases; the shares envelope table; the environments-delete doc): (c), unrelated. These pass a mocked envelope through, or belong to other routes.
• packages/client-react: no status or code branch at all. (c).
• packages/cli (package install response handling) and packages/verify (probeAsPersona): (c). The RLS proof judges a by-id write by ground truth (whether the row changed), and it only interpolates the status into a detail sentence.
• In-repo source that branches on PERMISSION_DENIED: (c). This covers the plugin-auth guard markers, canWriteObject, the explain route arm, and generic error classification.
• Tests: class (b), pins this ruling turns. They are listed below.
• The objectui console is NOT MEASURED. Its source is not readable from this seat. It is not reported as clean.

No class (a) dependency was found.

Turned pins

Every turned pin keeps its expects, flipped to the ruled answer. Each one was measured to turn.

• plugin-security:
  • security-plugin.test.ts: the pre-image deny case (a readable, unwritable row keeps PermissionDeniedError, with two reads now); the two "no write-class re-read" cases (now one plain read); and two owner-anchor cases whose double now holds the row.
  • explain-enforce-parity.test.ts: the same-class control's r2 update, and the own writer on a private object. Both now expect 404 RECORD_NOT_FOUND.
  • explain-cross-class-refusal.test.ts: the control's r2 update and its explain record.
  • explain-json-column-refusal.test.ts: the controls' update record for a hidden row.
  • position-catalog-refusal.test.ts: a foreign-organization row and a missing id are both 404 now, and their message is equal apart from the caller-supplied id.
  • store-fault-fail-closed.test.ts: an absent pre-image is now the not-found. An addressed by-id write now reaches the store, so a fault there propagates.
  • controlled-by-parent-sharing.test.ts: a missing detail id now gets the read door's producer.
  • get-writable-fields.test.ts and authz-matrix-gate.test.ts: the doubles answer the new read. The pinned verdicts are unchanged.
• plugin-auth: sys-user-self-service-route.test.ts PIN 2. The read question now appears in the recorded reads, and the 403 is unchanged.
• qa/dogfood, the two files the qa-lane declaration admits:
  • parent-derived-write-refusal-not-visible.dogfood.test.ts: the reference answer is now the not-found, and it is equal across principal classes apart from the id.
  • authored-row-write-scope.dogfood.test.ts: [E2E private], [no-leak 5] and [no-leak 6] on the private object.
• qa/dogfood, measured to turn beyond the first qa-lane declaration, admitted by the seat as surface revision 2 (review 5988217853; qa-lane amendment 5988222916 on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024): api-key-owner-revoke.dogfood.test.ts, attachments-permission-matrix.dogfood.test.ts, showcase-invoice-seed-isolation.dogfood.test.ts and flow-runas.dogfood.test.ts.
• Measured and not turning: the candidate tests in plugin-sharing, plugin-audit, service-storage, service-automation, runtime, rest and platform-objects.

New pins

• plugin-security/src/by-id-write-unreadable-not-found.test.ts runs on a real ObjectQL, a real SQL driver and the real middleware. It pins:
  • on update and delete, a hidden row's answer equals a missing id's;
  • a reader who may not write keeps 403 PERMISSION_DENIED with the record-level sentence;
  • a writable row is still written;
  • the cascade delete of a hidden dependent, and a hook's by-id write, keep the record-level 403 and name nothing;
  • the same caller addressing that row itself gets the not-found.
• security-plugin.test.ts: a hidden row answers the not-found, never PermissionDeniedError.
• NEW qa/dogfood/test/write-door-unreadable-is-not-found.dogfood.test.ts runs at the REST data door. It covers both principal classes (outside and inside the ownership floor's org_member domain, each proven by arming probes), update and delete, and sys_attachment and sys_comment. It pins:
  • the hidden row's whole answer (status and body) equals the missing id's;
  • a reader who may not write gets 403, from whichever gate answers it today;
  • the caller's own row is written and then deleted.

Ablation

Both ablations went through scripts/ablation-replace.mjs, on the mutation anchor in addressedByIdWriteId.

• A: put the skipped read question back. The read question was never asked. The marker reached dist/ (ablation-dist-preflight: present in 2 built files).
  • Unit: 4 pins red — both verbs' hidden-row equality, the addressed control, and the unit not-found case.
  • Dogfood: 8 of 8 hidden-row cells red, across both classes, both objects and both verbs. With the question gone, the inside class's delete answered 403 for a missing id too, which is the card's measured split.
• B: ask the question of nested writes too. The cascade and hook pins went red.
• Restore: proven each time. The blob equals HEAD (59831b78), git diff HEAD is empty, and dist/ was rebuilt and preflighted --absent with a clean tree.

Verification

All of this is on head 547a6726 unless stated.

• plugin-security: the full suite (166 files, 3634 tests, 0 failed) and typecheck (tsc plus scripts plus check:test-typecheck) both green.
• dogfood: typecheck green. The turned files and the new file are green. The full dogfood suite (182 files) was run in batches against plugin-security built from the fix commit, and every red was a turned pin listed above. After the fix commit, plugin-security source changed only in explain, where a redundant guard was dropped.
• plugin-auth: typecheck and the turned file are green.
• spec: the migration tests, and the two pins that read semantic entries, are green.
• Derived gates: dispatch-gates --commands lists 118 commands. All 118 exit 0 on 547a6726. The --ran reconciliation reads: 118 derived, 118 run, 0 NOT-MEASURED, 0 UNRUN.
• Lint, narrowed: eslint --no-inline-config over the 24 changed TypeScript files, 0 errors and 0 warnings. eslint.config.mjs enables no type-aware linting (no parserOptions.project, no typed rules), so this diff cannot move a verdict on an untouched file. The repo-wide run is CI's.
• Docs: content/docs sentences this made false are corrected: the attachments access table, the sharing-refusal note in the error-handling page, and the pre-image sentence in the permissions matrix.

Acceptance notes

• Flow runs. A by-id write issued by a flow run started at the automation door is not nested inside another engine operation, so it is treated as an addressed write and answers the not-found. That is the flow-runas turn. A flow started inside another write (a record-change trigger) is nested and keeps its previous answer.
• The parent-derived kits. Their not-visible PERMISSION_DENIED stays the gate's own answer, for a write the gate answers first. Their docblocks now say so (comment-only edits in service-storage and plugin-audit). Their unit suites are unchanged and green.
• A unit double in controlled-by-parent-sharing.test.ts returns rows regardless of the caller's read visibility. So its "hidden detail" case still asserts 403 at that seam, while the real stack answers that row with the not-found. It was not measured to turn, so it is not edited.
• Explain's reach. Explain's READ record verdict does not model a data middleware's read visibility, and it did not before this change either. Its new write-side question runs the real caller-context read, so the update and delete verdicts do see that visibility.
• Declarations:
  • Four existing dogfood files and one plugin-auth test turned beyond the first declared surface, as listed under "Turned pins". The seat admitted them in review 5988217853, and the qa-lane declaration was amended (5988222916).
  • The one step-18 ledger entry is the conditional spec declaration on [PM seat] domain:spec — 🟢 os-litant · session_01LAi5BVvQNiYzepSAcsoFLK #6017.
  • The landing needs the at-tier contract review the ruling requires.

Patch round 1 (head 2ce9723)

Appended by the seat (domain:services#1, session_011K3zqE8Pv1Evw5hc8tZCnN) from the dev's patch-round report 5989030715, after seat review 5988217853. The two declaration lines above were annotated in the same act.

• The one defect, fixed. The changeset frontmatter now names @objectstack/spec (patch). The step-18 ledger entry this PR adds ships under that package's ./migrations export. No other changeset line moved. Commit 2ce9723d.
• Merged origin/main (75ddcd1b) through scripts/pm/os-regen-merge.sh, as merge commit 921da525. The merge brought one plugin-security pin file, and text changes to other step-18 registry entries. Re-running gen:migration-registry produced no diff: the registry is current, with 377 semantic entries.
• Checks on 2ce9723d, under the verify lock: all three exit 0.
  • check-changeset-no-major --base origin/main
  • check-adr-0087-registration --base origin/main: registered by-id-write-unreadable-row-not-found, new here
  • check:migration-registry
• Derived gates re-run, because the merge touched plugin-security and the registry. dispatch-gates --commands lists the same 118 commands, and all 118 exit 0 on 2ce9723d. The --ran reconciliation reads: 118 derived, 118 run, 0 NOT-MEASURED, 0 UNRUN.
• The at-tier contract review runs on this head once its CI settles. Landing waits for its PASS.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/plugin-audit, @objectstack/plugin-security, @objectstack/service-storage, @objectstack/spec, touching 12 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/plugins/plugin-audit/src/comment-access-hooks.ts, packages/services/service-storage/src/attachment-access-hooks.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/authorization.mdx (via object_crud (literal, a string literal in explainAccess), required_permissions (literal, a string literal in explainAccess))
• content/docs/permissions/explain.mdx (via object_crud (literal, a string literal in explainAccess), required_permissions (literal, a string literal in explainAccess))
• content/docs/permissions/field-level-security.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/index.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/rls.mdx (via object_crud (literal, a string literal in explainAccess))
• content/docs/permissions/system-context.mdx (via explainAccessForCaller (symbol, a method of class SecurityPlugin))
• content/docs/plugins/packages.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/ui/forms.mdx (via SecurityPlugin (symbol, a top-level class))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/releases/v13.mdx (via object_crud (literal, a string literal in explainAccess), required_permissions (literal, a string literal in explainAccess))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/plugins/plugin-audit/src/comment-access-hooks.ts, packages/services/service-storage/src/attachment-access-hooks.ts) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 145 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 18c7dfd2e68cd2630420080b49a5f6a62fe60a6a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from aebb2a3fe67f7e2767dd61a51e48b73d6d5c18c1 — the merge of head 2ce9723d42edde850931e0656e1d6f9e9493b0b5 into base 18c7dfd2e68cd2630420080b49a5f6a62fe60a6a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin aebb2a3fe67f7e2767dd61a51e48b73d6d5c18c1 && git checkout aebb2a3fe67f7e2767dd61a51e48b73d6d5c18c1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 18c7dfd2e68cd2630420080b49a5f6a62fe60a6a 2ce9723d42edde850931e0656e1d6f9e9493b0b5 && git checkout -B drift-repro 18c7dfd2e68cd2630420080b49a5f6a62fe60a6a && git merge --no-ff 2ce9723d42edde850931e0656e1d6f9e9493b0b5

node scripts/docs-audit/affected-docs.mjs --json 18c7dfd2e68cd2630420080b49a5f6a62fe60a6a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 18c7dfd2e68cd2630420080b49a5f6a62fe60a6a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2ce9723d42edde850931e0656e1d6f9e9493b0b5
Local-runs: none

① Derived judgments

Inputs read: card #21771 body and all eight comments (triage routing, ruling A, the claim, the stop report, the seat verdict, the done report, the seat's patch-round review, the patch-round report), PR #21812 body, file list (28 files, 1056/78), the three-dot diff against origin/main at the merge-base, and the check-runs on the head. Source read in git objects at the head only.

1. Accept-set narrowing — right, and the one the ruling owns. security-plugin.ts step 2.7 now asks callerCannotReadAddressedRow for every principal class. The new else if arm covers the principal no write-class row filter binds: a by-id update or delete it addressed on a row the read door hides is refused with recordNotFoundError before any later gate (sharing, the parent-derived kits) can admit or refuse it. This refuses writes that used to land (the kits' uploader/author arm with a hidden parent). Ruling A 5985885287 and the seat's Q1 → A 5986522256 order exactly this; the claim line "no change to who may write" was withdrawn there. Pinned on a real engine in by-id-write-unreadable-not-found.test.ts and at the REST door in write-door-unreadable-is-not-found.dogfood.test.ts: both principal classes (inside and outside the ownership floor's org_member domain, each proven armed), both verbs, both measured objects, whole answer equal to the missing id's apart from the caller-supplied id, row left in place.

2. Answer change 403 → 404 for the bound principal — right. In the writeParts.length > 0 arm, a write-class re-read that returns nothing now asks the read question; absent → the read door's not-found, present → the record-level PERMISSION_DENIED as before. The write-class re-read runs under the caller's context through the engine, so a row it returns is readable, and the "reader who may not write keeps 403" leg holds in both arms (bound: the record-level 403; unbound: no throw at 2.7, the later gate answers, and the new dogfood file pins the answering gate's code per class and verb). A re-read that THREW skips the read question (reReadThrew) and keeps the denial. Right.

3. Absence classification — right against binding constraint 1. absentUnderCallerRead answers true only for an empty read, false for a declared 4xx (declaredHttpStatus, both spellings), and rethrows anything else. store-fault-fail-closed.test.ts now pins that an addressed by-id write reaches the store and propagates an outage rather than relabelling it. One shared classifier serves the write path and explain. The cost the seat accepted is real: every addressed by-id write now performs one caller-context read even where no write filter binds (the former "no extra read" design pin turned); the getCallerPreImage memo shares that row with steps 3.5 and 3.6, so it stays one read per operation.

4. Nested-write exclusion — right, no engine edit. engineOperationScope (an AsyncLocalStorage owned by the plugin) is read at middleware entry before the scoped next opens; every exit of the middleware calls the wrapper, so hooks, the cascade and the driver call all run inside it, and a by-id write started there reads as nested and keeps today's answer. The FK clear stays excluded by its server-derived marker. Pinned with the real engine: the cascade of a hidden dependent and a hook's ctx.api write both keep the record-level 403 naming nothing, while the same caller addressing that row gets the not-found. Consequence judged and accepted: a flow run started at the automation door is not nested, so its by-id write to a hidden row answers the not-found (the flow-runas turn), while the same flow fired from a record-change trigger inside another write keeps the 403. The answer depends on where the flow started; it is the Q2 → A line applied honestly, and a runAs: user flow can only name ids from caller input or rows the caller reads, so no existence signal crosses.

5. By-id versus predicate — right. addressedByIdWriteId reads the engine's own resolveEngineUpdateDispatch / resolveEngineDeleteDispatch, update and delete only. extractSingleId still picks the re-read's target; the two agree on every by-id dispatch (payload id outranks where.id in both), and the dispatch predicate is the stricter, so the question is never asked of a predicate write. Lifecycle verbs keep the old pre-image check; none of them is a live by-id door today.

6. Explain parity — right. ExplainEngineDeps.recordAbsentToCaller is wired in security-plugin.ts through the same classifier over readRowById under the target context; the override applies on update and delete past the capability and object-CRUD deciders and leaves the already-missing shape alone, so the record verdict becomes visible: false with no decider exactly where enforcement answers the not-found. The parity, cross-class and JSON-column suites turned to that shape with every expect kept. Public surface: ExplainEngineDeps is an exported type of plugin-security and gains one optional member — additive, inside minor.

7. Producer — right. The answer is recordNotFoundError from @objectstack/core, the read door's own; no new code or body. controlled-by-parent-sharing.test.ts dropped its statusCode assertion because the core producer spells status once; both transports resolve either spelling, so the wire is unchanged.

8. Spec surface — right. One D3 semantic entry in step 18 (18.by-id-write-unreadable-row-not-found.ts plus the regenerated registry.ts row), no Zod schema, docblock or export moved; check:migration-registry, check:upgrade-guide and check:api-surface are green on the head through the required jobs.

9. Docs — accurate. The attachments access table now separates the not-found for a by-id write of an unreadable attachment from the gate's own PERMISSION_DENIED where the gate answers first (a nested or predicate write); the permissions-matrix callout and the error-handling note say the same thing. The comment-only docblocks in service-storage and plugin-audit change nothing those packages publish.

10. Gate verdicts on the head (latest run per check name): the seven required contexts — Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard — all success; Console Pin Gate and Packed-tarball smoke (opt-in) skipped by design; the later Check PR Size and Auto Label runs skipped on the edit event after earlier successes, advisory. No governed-surface path in the file list; 1134 changed lines; the PR is draft, assigned, and closes the card.

② Semver level

.changeset/21771-write-door-unreadable-is-not-found.md: @objectstack/plugin-security: minor with the ! banner, @objectstack/spec: patch. The PR body's line 2 and the changeset body both carry Clause-②: no (narrowing), and that matches the diff: no accepted input widens, and item 1 above is the narrowing. BREAKING per the Post-Task Checklist, so the body carries what a breaking changeset owes — the FROM → TO, the one-line handling for an affected caller, and the ADR-0087 marker registered by-id-write-unreadable-row-not-found, which the gate reads; Check Changeset is green. minor is the launch-window convention the check-changeset-no-major header records for an accept-set narrowing. patch on spec is right: the registry row ships under its ./migrations export, nothing in spec's schema or export surface moves, and the previous landing of this same shape (a non-spec breaking change carrying one D3 entry) took "@objectstack/spec": patch. The double-quoted frontmatter line is valid YAML; cosmetic.

③ Boundary flags

Open questions: the done and patch-round reports carry none; the three in the stop report 5986486910 were answered in 5986522256 (Q1 A, Q2 A, Q3 A) and built as ruled — verified in items 1, 4 and 6.

Dev flags from 5988175661:

• Turned pins beyond the declared surface (four dogfood files, one plugin-auth test) — answered: admitted by the seat in 5988217853, qa-lane declaration amended (5988222916 on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024); every expect kept and flipped to the ruled answer, checked in the diff.
• Comment-only docblocks in the two parent-derived kits — answered: accepted; prose this change made false; no code line.
• ADR-0087 registered with one step-18 entry under the conditional [PM seat] domain:spec — 🟢 os-litant · session_01LAi5BVvQNiYzepSAcsoFLK #6017 declaration — answered: the FROM → TO is a prescription, so registered is the honest disposition; the entry is generated and the registry is current (patch-round report).
• Flow runs started at the door count as addressed — answered: accepted, with the consequence stated in item 4.
• One typecheck read outside the verify lock — process only; the required type-check job is green on the head.
• Dogfood full suite measured against a dist built from the fix commit — superseded by Dogfood Regression Gate 1/3–3/3 success on this head.
• Ablations on pre-squash commits with an identical security-plugin.ts blob — accepted; blob equality named.

Dev flags from 5989030715:

• Double-quoted changeset line — cosmetic; gates green.
• Merge commit 921da525 carries git's default message without the session trailer pair — the pre-push hook passed it and the squash landing collapses it; no action.

Escalated, not blocking:

• The objectui console leg stays NOT MEASURED. The ruling's census asked it; this seat cannot read that repository and Console Pin Gate skips on a PR that does not opt in, so nothing on this head measured whether the console branches on a by-id write's 403 as "exists but no access". The seat has named it to the maintainer; it stays named here as an open census leg, never reported clean.
• One residual principal class, abstract. A principal holding an object's write grant without its read grant, bound by no write-class row filter. The permission bits are independent (only the wildcard super-user fold pulls read true from modify), so the class is declarable. For it the caller-context read is REFUSED with a declared 4xx, which binding constraint 1 classifies as not-absence, so the write keeps today's path: a missing id reaches the engine's not-found while a hidden row reaches a later gate's refusal or lands. The split the card measured therefore persists for that class. The ruling's text ("this is the read door's answer") does not settle it — the read door refuses that principal for every id — and the seat chose the classification deliberately. Not a defect of this PR against its ruling; a doctrine question for its own card.
• No ADR holds the governing text. "Hidden and gone are one answer on the write doors" lives in the ruling comment, the changeset, three docs pages and code comments; triage noted no ADR recorded the prior doctrine either, and ADR-0120 S10 is extended by the ruling's words without an amendment. Tier H, the maintainer's act; noted for the round report, not owed by this PR.

Implemented-by: claude/issue-21771-write-door-unreadable-is-not-found
Reviewed-by: session_011K3zqE8Pv1Evw5hc8tZCnN

VERDICT: PASS