Four Layer 0 shapes are no longer pinned AS RECORDED VERDICTS after the #15813 retarget — correct by construction, but nothing would notice them breaking

[claude]

⛔ Ungraded and unrouted — domain:*, priority and type are triage's. Filed unassigned by the domain:engine dispatching seat, discharging an escalation from PR #15878's contract review (adopted verbatim on card #15813 at 5551879308, §4).

What is not pinned

PR #15878 delivers the #15706 option-(i) seam: plugin-security records its Layer 0 verdict on the operation context, and the bulk data-event producer reads it instead of re-deriving the wall. Doing that required retargeting a block of pins in packages/objectql/src/engine-data-events.test.ts — and the retarget was judged honest, not convenient, with a measurement behind it: the five old positive pins drove setTenancyPostureProvider plus a stub driver and no SecurityPlugin at all, so they were asserting the engine's own re-derivation with no wall ever composed. Under (i) they must flip. ⛔ Nothing here disputes that.

What the retarget thinned is the subject of this card. Three object shapes and one composition were pinned at the old block's level and are now covered only indirectly:

what	where it rests now
systemFields.tenant: false + an author-declared column (P1)	pre-existing security-plugin.test.ts shape pins + the 「the filter IS the projection」 pin
the #7835 phantom anchor	same
a custom tenancy.tenantField	same
the on-behalf-of intersection (intersectTenantLayer0Verdicts, security-plugin.ts:3088)	unit-pinned only — the middleware line itself has no pin

⇒ each is correct by construction today. None is pinned as a recorded verdict in tenant-layer0-verdict-on-operation.test.ts.

⭐ Why "correct by construction" is the reason to file this, not the reason not to

The seam's whole value is that the verdict the plugin records is the same object the predicate is projected from — one computation, two readers. A shape that is correct because the projection is correct stays correct only while that identity holds. The pin that would catch its breaking is precisely 「for shape X, the recorded verdict is Y」, and that is the pin that does not exist for these four.

⛔ This is not a claim that anything is broken. It is a claim about what would notice if it broke — and after this PR the answer for these four is 「the composition pins, one layer away」.

What would close it

Middleware-level pins in tenant-layer0-verdict-on-operation.test.ts that assert the recorded verdict for: the three object shapes above, and the on-behalf-of intersection at security-plugin.ts:3088. ⛔ This seat does not size that, does not rank it against the other cards, and does not grade it.

Related

#15813 (the seam card) · PR #15878 (the delivery) · #15706 (the ruling, option (i)) · #15831 (a separate residue from the same review — the driver leg's carve-out miss) · #15225 (the p0 whose block was retargeted).

Dedup: ⚠️ /search/issues answers 403 in this container and an empty search is not a reading — so this was a repo-scoped REST list of open issues plus the review's own escalation list. No open card carries the recorded-verdict pin gap.

Re-check

git show origin/main:packages/plugins/plugin-security/src/security-plugin.ts | grep -n 'intersectTenantLayer0Verdicts'
git grep -c 'intersectTenantLayer0Verdicts' -- packages/plugins/plugin-security/src   # control: the unit pins exist
git grep -n 'tenantAnchorIsPhantom' -- packages/plugins/plugin-security/src           # the #7835 shape

---

Generated by Claude Code