fix(plugin-security): correct R1 door-order prose in object-posture-gate.ts

[os-warren]

Fixes #9957

Comment-only accuracy edit: the only file touched is packages/plugins/plugin-security/src/object-posture-gate.ts, and the only change is the R1 header parenthetical at lines 93-94 (pre-edit). The executable guard (if (!ctx.isArtifactBacked) return;) is untouched.

What was wrong

The parenthetical read: "the OS_METADATA_WRITABLE escape-hatch path — the default deploy already 403s these before this gate runs." Measured false on a genuinely stock showcase boot (#9477, landed PR #9953, checklist item revision 3): saveMetaItem runs runAuthoringGate (which is R1) ahead of the overlay/package doors on the host-config kernel the showcase boots (environmentId undefined, so protocol.ts's env-partitioned NOT_OVERRIDABLE branch never arms — that file's own #7674 note records this is the flagship showcase's boot shape). A widening body meets R1 first on every leg, hatch open or closed, ?package= named or not. The "earlier" refusal the old prose named is real, but it answers later — only for bodies R1 lets through.

What changed

Replaced the parenthetical with the measured mechanism:

• The answering layer is picked by the body's DIRECTION, not by deploy posture.
• On the host-config kernel, R1 runs ahead of the overlay/package doors (cites the framework's own owd-save-gate: the ADR-0090 D11 authoring gate never runs on any host-config deployment (keyed on environmentId, not authoringChannel) #7674 note).
• A non-widening body passes R1 and only then meets the overlay door: 403 NOT_OVERRIDABLE (no ?package=) or 403 ITEM_LOCKED (?package= naming the read-only base) on stock; 200 under the escape hatch.
• WRITABLE_PACKAGE_REQUIRED — the code the old prose implied — appeared on none of the six measured legs.
• One line on the wire shape: code: PERMISSION_DENIED with declaredCode: owd_widening_forbidden, so a check keyed on code alone misses it (dispatcher-error-vocabulary.ts's owd_widening_forbidden row rationalizes its pending registration from a wire shape the live route does not produce (code vs declaredCode) #9958).

Refs: #9477 (six-leg evidence table) · PR #9953 (revision-3 ledger entry) · #9958 (the code/declaredCode wire-shape finding, same evidence base).

Premise check

Re-verified at branch point (73cfddfa9) that the parenthetical still reads as quoted — it wraps across two lines (a single-line grep for the tail alone misses it), confirmed at object-posture-gate.ts:93-94 immediately above the isArtifactBacked guard. Premise valid.

Verification (comment-only diff — package suite/typecheck expected unchanged from main; final HEAD 674b0db8e)

• pnpm --filter @objectstack/plugin-security test -- --maxWorkers=2 — 66 files / 1295 tests passed, no change in count from the pre-edit tree.
• pnpm --filter @objectstack/plugin-security typecheck — clean, exit 0.
• pnpm check:cross-package-test-inputs / node scripts/check-cross-package-test-inputs.mjs — OK (12 packages, all declared).
• pnpm check:slot-lookup — ratchet holds, 107 unswept sites in 25 files, none new.
• pnpm check:test-source-alias — OK, 72 packages scanned.
• pnpm check:type-source-resolution — OK, 76 packages scanned.
• node scripts/docs-audit/check-affected-docs.mjs — self-test 262 cases pass; sdk route bridge output unchanged (pre-existing baseline, unrelated to this diff).
• node scripts/pm/dispatch-gates.mjs (no paths, self-derived from the committed diff at 674b0db8e) — same 6 named families as at dispatch time, plus one convention-triggered addition: pnpm check:i18n (the package owns an i18n-extract.config.ts). Ran it to completion (built @objectstack/cli first per its own PREREQUISITE-NOT-MET message) — PASS, 9 packages, all bundles in sync, no undeclared authoring keys. No diff-review needed to predict "nothing to extract" since it was actually run: confirmed by the OK output.
• pnpm check:nul-bytes — OK, 6345 tracked text files scanned, no raw control bytes.

No ablation applies — nothing executable changed, so there is no mutation/restoration pair to test.

Changeset

skip-changeset label applied (this repo's real mechanism — PR #9918 is the recent worked example for a comment-only diff in a published package; objectui uses an empty-frontmatter changeset instead, not applicable here). Rationale: comment-only prose change, zero user-visible or runtime behavior change, nothing to release.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/authorization.mdx (via objectPostureGate (symbol))

What this run could not see

• the SDK route bridge reached 45 of 221 client-bound route-ledger rows — the other 176 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run: node scripts/docs-audit/affected-docs.mjs --bridge-coverage

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 73cfddfa9ceed60537ae75605c529744b62f0567 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 0a053d2ef28dcfbaef35c7f6c21bb773726ed236 — the merge of head 674b0db8e7968e9ef6948afc72252d53f09fbe53 into base 73cfddfa9ceed60537ae75605c529744b62f0567, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0a053d2ef28dcfbaef35c7f6c21bb773726ed236 && git checkout 0a053d2ef28dcfbaef35c7f6c21bb773726ed236
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 73cfddfa9ceed60537ae75605c529744b62f0567 674b0db8e7968e9ef6948afc72252d53f09fbe53 && git checkout -B drift-repro 73cfddfa9ceed60537ae75605c529744b62f0567 && git merge --no-ff 674b0db8e7968e9ef6948afc72252d53f09fbe53

node scripts/docs-audit/affected-docs.mjs --json 73cfddfa9ceed60537ae75605c529744b62f0567

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 73cfddfa9ceed60537ae75605c529744b62f0567 → pass the list as
args.docs, on the commit named under Which tree this was computed on.