* fix(#2078): separate mutation lookup from view access

Resolve UUID locators as unfiltered identities, matching numeric repository lookup, before each controller caller applies its operation-specific access decision.

spec-reviewed: docs/specs/api-layer.md

spec-reviewed: docs/specs/jsonapi.md — primary JSON:API mutation surface and attribute contract unchanged

spec-reviewed: docs/specs/access-control.md — existing view/update/delete decision semantics unchanged

spec-reviewed: docs/specs/workflow.md

* feat(#2079): add authorized relationship traversal

Keep relationship endpoint selectors Protected while exposing one principal-scoped, fixed-shape traversal facade for authorized application consumers.

spec-reviewed: docs/specs/relationship-modeling.md — principal-scoped application traversal contract added

spec-reviewed: docs/specs/entity-field-read-boundary.md — sealed endpoint decision retained with an authorized domain seam

spec-reviewed: docs/specs/access-control.md — existing entity view decision semantics unchanged

spec-reviewed: docs/specs/workflow.md — no workflow or release behavior changed

* feat(#2079): add relationship-authorized member directory

Add an exact-group, opt-in ReBAC directory facade backed by verified live direct membership and a fixed sealed endpoint projection. Keep broad authorization separate, support both relationship storage layouts, and require a fail-closed consistent-read database capability.

spec-reviewed: docs/specs/relationship-modeling.md — exact-group non-transitive directory contract and storage/snapshot rules added

spec-reviewed: docs/specs/access-control.md — broad and scoped authorization branches remain isolated

spec-reviewed: docs/specs/entity-field-read-boundary.md — fixed directory projection preserves sealed account fields

spec-reviewed: docs/specs/content-workflow.md — membership transition semantics remain unchanged

spec-reviewed: docs/specs/stability-charter.md — new database capability is additive and public-surface mapped

spec-reviewed: docs/specs/workflow.md — design-first issue and fresh verifier gates followed
spec-reviewed: docs/specs/entity-system.md — fixed rawProjection authority is internal and preserves ordinary read behavior

* fix(#2078): audit authorized media source reads

Route the sealed media source locator through a typed strict-audit capability after entity-view authorization, with one-boundary authority that is always revoked.

spec-reviewed: docs/specs/entity-field-read-boundary.md — media source_uri crosses the strict audited capability seam

spec-reviewed: docs/specs/entity-storage-two-axis.md — audited downloads do not activate or alter parked revision axes

spec-reviewed: docs/specs/stability-charter.md — additive reader interface is classified in the public-surface map

spec-reviewed: docs/specs/workflow.md — gap is issue-traceable with its regression and changelog entry

* fix(#2078): honor canonical media files directory

Resolve canonical files_dir for upload and download routing while retaining explicit legacy files_root precedence.

spec-reviewed: docs/specs/infrastructure.md — canonical files_dir resolution and legacy precedence are documented

spec-reviewed: docs/specs/entity-storage-two-axis.md — file-root configuration does not activate or alter parked revision axes

spec-reviewed: docs/specs/workflow.md — gap is issue-traceable with its regression and changelog entry

* fix(#2078): attribute authored drafts to creators

Assign omitted node authorship from the authenticated JSON:API principal so admin-created drafts participate in own-unpublished access.

spec-reviewed: docs/specs/api-layer.md — documents authenticated default authorship on node create

spec-reviewed: docs/specs/access-control.md — owner matching and anonymous fail-closed semantics are unchanged

spec-reviewed: docs/specs/field-access.md — explicit create-on-behalf authorship and existing-node sealing remain unchanged

spec-reviewed: docs/specs/workflow.md — bounded release-batch gap remains anchored to #2078

* fix(#2081): derive working-copy view from workflow authority

Let exact current-state transition authority add entity view while preserving existing mutation checks, field sealing, group constraints, and anonymous fail-closed behavior.

spec-reviewed: docs/specs/content-workflow.md — defines exact current-working-copy transition authority as an additive view opinion

spec-reviewed: docs/specs/access-control.md — preserves Forbidden-wins composition by returning Neutral on every non-match

spec-reviewed: docs/specs/field-access.md — workflow visibility supplies no field-read policy and sealed fields remain sealed

spec-reviewed: docs/specs/api-layer.md — all workflow endpoints retain the shared entity-view gate and concealed denial shape

spec-reviewed: docs/specs/admin-spa.md — detail, list, edit-load, and workflow controls consume the shared policy

spec-reviewed: docs/specs/entity-field-read-boundary.md — hydrated evaluation is required because base projections cannot prove current revision state

spec-reviewed: docs/specs/workflow.md — bounded design was anchored to #2081 and independently verified before implementation

* test(#2080): update intended inventory parity expectations

Record the exact AuthorizedRelationshipTraversal sealed-reader addition and the single WorkflowAuthorityAccessPolicy discovery addition.

spec-reviewed: docs/specs/field-access.md — sealed-reader inventory remains exact and non-exported

spec-reviewed: docs/specs/workflow.md — workflow authority policy is the sole intended new discovered policy