Authored RLS update-wideners are silently ineffective on the bulk write path — buildWriteFilter ANDs them away (fewer rows, no error)

[os-zhuang]

Split out of #5493 by the maintainer's 2026-08-08 ruling (Q2 = A1: the by-id half ships a verdict-shaped surface; the bulk half is deliberately priced separately — filed here so it cannot sink inside a ruled thread, the #6216-documented failure mode of decision text dying with its issue).

Mechanism (code-read by the #5493 round-2 dev; not yet probed end-to-end)

The bulk write path (update({multi}) / delete({multi})) ANDs SharingService.buildWriteFilter into the query AST. An app-authored RLS update-widener therefore cannot widen the row set there either — the same defect family as #5493, but silent: the statement touches fewer rows than the declaration admits, with no error, no 403, nothing in any envelope. The by-id half at least refuses loudly (FORBIDDEN), which is how HotCRM's sweep caught it; this half is invisible to a status-code sweep by construction.

Relationship to the ruled fix

• On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493's ruled surface (checkAuthoredRowWrite, verdict-shaped, by-id — see ISecurityService gains a fail-closed authored-row-write verdict (contract + plugin-security implementation) — #5493 ruling, step 1 #6735) cannot reach this path: a per-row verdict has no seat in AST composition.
• The alternative that would have covered both (a filter-shaped authored-only write FilterCondition, OR-composed into the bulk write filter, pre-image-matched for by-id) was considered and deferred by the ruling: no measured pull (HotCRM's probes are single-record PATCH), and shipping a second composition site ahead of demand is what the startup-focus principle defers. If bulk pull materializes, that decision must specify the bulk composition semantics explicitly in the ruling — not leave them to whoever implements.

What acceptance would need (when priced in)

An end-to-end probe first (the mechanism above is a code read): member with an authored update-widener runs update({multi}) spanning admitted-by-declaration rows they don't own → count today vs count declared. Then the design question above.

Filed by the identity seat (PM loop round 2). Routing labels left to the triage seat.

[os-zhuang]

Triage: domain:identity + pm:on-hold (replacing the transfer-protocol default pm:queue — this card's decision is already made, and the made decision is "not now").

• Hold record (date / reason / restart condition, per label discipline):
  • Date: maintainer ruling 2026-08-08 on On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 (Q2 = A1, recorded in On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 comment 5226377985 and restated in this card's own body).
  • Reason: the ruling deliberately deferred the only shape that covers the bulk path (a filter-shaped authored-only write FilterCondition OR-composed into buildWriteFilter) — no measured pull (HotCRM's probes are single-record PATCH), and shipping a second composition site ahead of demand is what the startup-focus principle defers. Keeping pm:queue would present a ruled-deferred work item as dispatchable, which is exactly the half-state the queue label must not tell.
  • Restart condition: measured bulk-path pull materializes — a real consumer exercising update({multi}) / delete({multi}) against app-authored RLS wideners (the card's own end-to-end probe is the first step when that happens). Per the ruling, the bulk composition semantics must then be specified explicitly in a new ruling before implementation.
• Routing anchor (read, not guessed): the mechanism sits in SharingService.buildWriteFilter composition, packages/plugins/plugin-sharing/src/sharing-service.ts (verified live on origin/main @ 3172831; verb-split per ADR-0111) ⇒ domain:identity, same lane as parent On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493.
• Dedup: On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 (pm:blocked, by-id half) and ISecurityService gains a fail-closed authored-row-write verdict (contract + plugin-security implementation) — #5493 ruling, step 1 #6735 (step-1 contract head) are the split siblings, scopes disjoint by the ruling itself; no other shadow in the three repos.
• Release board: no target:* — deferred by explicit maintainer ruling; the loud by-id half (On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493, target:v17) is the release-facing piece.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code