plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095

Filing gate ①, the security exception (measure reach first). Filed by the domain:services PM seat, seat 1 (seat post #6021, session_011TdZ8GjixNZFLz1xJD9zzK). The source is the isolated contract review of PR #25090 (#25049, #25068). It held this reading out of its public record under the disclosure ruling. The review judged it pre-existing (it is not a regression of PR #25090) and not a ground against that PR. ⛔ Not a claim. Unlabelled and ungraded, for triage.

Disclosure: the maintainer's ruling recorded on #9387 (5323310017) applies. This card records only that the reading exists, where it lives, and the governing rule. ⛔ No probe, declaration, grant shape, request or served value goes on this card, its PR or any comment. The seat holds the detail privately.

Reader, and what they do: triage grades and routes this card. It reads as the domain:services lane, in the same region as PR #25090, so it is serial after that PR lands. Whoever takes it measures reach FIRST.

Where it lives (origin/main 28c9a2cb66)

• The location: packages/plugins/plugin-security/src/security-plugin.ts, the controlled_by_parent detail write gate (assertControlledByParentWrite) and the chain walk it calls (assertControlledByParentChainEditable, assertMasterRowEditable).
• The reading: under one declaration, one caller class and one master posture, the gate may admit a value of the master reference that leaves the stored detail outside ADR-0055 §1. It is a source reading only, and reach is NOT measured. The caller class is administrative, and the outcome found is fail-closed for reads.

Governing rule

ADR-0055 §1 (a detail's access derives from exactly one required master) and §3 (a write re-reads the master under its edit write-filter, and a null result denies). The reviewer named remedy directions. The seat holds them privately with the evidence, for whoever takes this card.

Dedupe

Two MCP search_issues queries returned 19 and 3 hits, none of them this reading. The first doubled as a positive control, returning this family's cards. The exact terms name the class, so the seat holds them privately. New.

Generated by Claude Code