docs(permissions): the attachments 401 row covers the posture-driven key refusals

[claude]

Fixes #16018

The attachments download gate's AUTH_REQUIRED (401) row listed only the anonymous case. Now that the four tenancy-posture doors have landed, the same 401 is also the answer for two more credentials. This extends the row once for the whole family rather than writing the same paragraph on four cards.

What changed

One file, one section — content/docs/permissions/attachments-access.mdx, the "Download — authenticated & parent-scoped" table (the AUTH_REQUIRED row) plus a follow-on passage under it. The enforcement-summary row further down is untouched: its wording does not contradict the extended row.

It is an addition, not a correction

The row was already a simplification before this family — an unknown, revoked or expired API key has always produced the same 401 — so no published claim was false. This is an extension of a simplifying row, not a repair of one.

The two measured non-uniformities are stated, not flattened

Re-verified on the merge base against the door this page actually documents (service-storage), not assumed:

• postureEnforcesWall(posture) is posture !== 'single'; postureUsesUnionScope(posture) is posture === 'group' (packages/spec/src/security/tenancy-posture.ts:53 and :80).
• organization_membership_ended is gated on postureEnforcesWall alone (packages/core/src/security/resolve-authz-context.ts:480) so an ex-member's org-stamped key is refused under both group and isolated.
• organization_required additionally requires !postureUsesUnionScope (packages/core/src/security/api-key.ts:370) so an organization-less key is refused under isolated only — under group it stays admitted.
• The door's own pins agree, at the wire: packages/services/service-storage/src/file-read-tenancy-posture-admission.test.ts section 6 asserts 401 for the ex-member's key and 200 for the organization-less key under group.

So the page says "refused under both group and isolated" for one key kind and "refused under isolated only" for the other. It never says "under group these keys are refused".

No outage status is documented. The outage answer differs per door and is not the declared 503 anywhere measured; #15999 remains open for that divergence and is not addressed here.

The 401 also stays the generic answer on the wire: both refusals leave userId unset, so the response is byte-identical to sending no credential at all and the reason goes to the server log only. The page says that, because it is why the refusal is a 401 rather than a 403.

Verification

All 39 gate families derived for this diff were run locally and are green:

node scripts/pm/dispatch-gates.mjs --changed --ran RAN_FILE reports 39 derived famil(ies) accounted for — 39 run, 0 NOT-MEASURED.

That includes the docs corpus gates (check:doc-anchors, check:doc-authoring, check:docs-single-h1, check:docs-redirects, check:docs-audit-scope, check:docs-transcript-drift, check:role-word, check:nul-bytes, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index), the two lint-owned docs gates (check:doc-formula-expressions, check:doc-security-posture) and the spec docs gates (check:docs, check:skill-examples, check:liveness, check:empty-state, check:strictness-ledger, check:variant-docs, check:yaml-examples), each after @objectstack/spec / @objectstack/lint / @objectstack/client-react were built under the shared verify lock.

pnpm lint was narrowed to the changed file, and the narrowing is measured rather than asserted:

• population: eslint --no-inline-config --format json on the changed file returns File ignored because no matching configuration was supplied — .mdx is in no files: glob of eslint.config.mjs, whose population is {ts,tsx,mts,cts,js,jsx,mjs,cjs};
• count: 1 file in the diff, 0 of them inside eslint's population, errorCount: 0;
• invariance: this repo's config never enables type-aware linting (no parserOptions.project, no typed rules — stated in eslint.config.mjs and confirmed by grep), so a docs-only diff cannot move the verdict on any untouched file.

skip-changeset: the diff publishes from no package (content/docs/** only).

---

Generated by Claude Code