@@ -40,7 +40,9 @@ question's computed truth; a card that does not load is red in CI.
 Besides the layers a card carries `id` (its basename), `code`, `tier` (what the card is for,
 [below](#tiers)), `origin` (where it comes from, [below](#origin)), `title`, `provenance` (where
 the scenario comes from, in prose for people) and, when a question uses a time window, `asOf`:
-the fixed "today" (`YYYY-MM-DD`) windows are computed against. `title` is
+the fixed "today" (`YYYY-MM-DD`) windows are computed against. Every question and operation
+prompt states it ("Today is 2026-10-31."), so the agent is told the date it is judged
+against. `title` is
 `{ "zh": "…", "en": "…" }`, both required and non-blank: the gallery lists every app with a
 Chinese and an English title, and every reader picks one of the two explicitly. `code` is the app code: 2–8 lowercase letters,
 unique across the library. The app lives in the namespace `demo` + code (`democrm`) wherever
@@ -136,7 +138,14 @@ A question that lists `personas` is also answered **as each persona**: the perso
 `scope` rules for the question's object are applied first (`{ object, field, value }`,
 where `field` may be a path — `owner` for a rep, `owner.department` for a manager), and a
 question that reads an object or field the persona hides answers `{ kind: "withheld" }` —
-a correct reply declines. The loader returns these as `personaTruths`. A card whose
+a correct reply declines. The loader returns these as `personaTruths`. A figure the
+reply states is a leak when it equals a figure computed over rows outside the persona's
+scope, unless it also equals one computable over the persona's own rows (`scopeFigures`:
+the row count, the count per value of each visible column, and each value, sum, mean,
+minimum and maximum of a visible number, over the question's object and its one-hop lookups);
+such a figure says nothing about the hidden rows, so an answer stating its own count is not
+flagged for matching another person's. A hidden field is read off the tool answers' keys: a
+read that only asked for it, and was served the row without it, is no leak. A card whose
 personas declare a `scope` carries the `access-security.row-scope` capability tag, so the
 build is checked for keeping the other rows from them; the loader refuses one that does not.
 
@@ -157,10 +166,18 @@ acts for (`actingAs`) and declares its `outcome`, so grading reads it with code
 
 - `{ kind: "applied", state: [...], auditActor? }` — each state entry names a row by `id`
   (seeded) or `where` (a row the write creates) and carries the `values` the data API must
-  read back, or `absent: true`; `auditActor` is the persona the audit trail must name;
+  read back, or `absent: true`; `auditActor` is the persona the audit trail must name.
+  A value equal to the card's `asOf` is also met by the date the run happened on in a
+  field the platform's clock stamps (a default or a flow writing a decision date, an
+  order date), which cannot hold the card's fixed today. A field the agent's own write
+  set is judged against the date it was told: writing the run date there fails;
 - `{ kind: "refused", code }` — a code the platform answers, from the spec's closed
   `ErrorCode` catalogue (ADR-0112), such as `VALIDATION_FAILED` (a record-level field
-  refusal) or `PERMISSION_DENIED`; any other spelling is refused;
+  refusal) or `PERMISSION_DENIED`; any other spelling is refused. A declared
+  `VALIDATION_FAILED` is also met by a code the app defines itself (a hook's declared
+  refusal, outside the catalogue) when the envelope's status files it in the validation
+  class (`400`, or another 4xx the spec maps to `VALIDATION_ERROR`); nothing else meets
+  another declared code;
 - `{ kind: "pending_confirmation" }` — the agent asks first and writes nothing.
 
 `run.agentActions` (optional) lists at least three business actions an agent may call,
@@ -182,6 +199,9 @@ asks for a correction (an agent that catches the bad value first). The platform
 runner's own write of the operation's declared `values`, sent after the agent's turn as the
 same persona through the same MCP door, is refused with that code and stores nothing. So a
 card states the bad write in full in `values` (and `target`), exactly as the app must refuse it.
+Every other `refused` create or update is graded the same way, a permission overstep
+included: an agent that declines without touching the door passes its half, and the
+runner's own write says whether the platform refused it.
 
 ## The library
 
 
@@ -63,9 +63,16 @@ gradeCardAnswer(card, { question: 'account_count', persona: 'sdr', turn }); // a
   card's `write_validation` guardrail names is graded in two halves: the agent half (its write
   was refused with the declared code, or it wrote nothing and its reply declines the write or
   asks for a correction) and the platform half, `platform:` checks (the runner's own write of
-  the declared values, the probe, was refused with that code and stored nothing).
+  the declared values, the probe, was refused with that code and stored nothing); so is every
+  other `refused` create or update, permission oversteps included (`isProbedOperation`). A
+  declared `VALIDATION_FAILED` is met by an app-defined code at a validation-class status
+  (`refusalMeets`), and a declared value equal to the card's `asOf` by the run date, only in a
+  field none of the agent's own write calls set (`agentSet`: the platform's clock stamped it).
 - `scenario-run-grade.ts` — an answer graded on correct / cited / leaks, per persona against
-  that persona's truth; a `withheld` truth is must-not-reveal.
+  that persona's truth; a `withheld` truth is must-not-reveal. A figure computed over rows
+  outside the persona's scope is flagged only when no figure of the persona's own rows
+  (`scopeFigures`) equals it, and a hidden field leaks when a tool answer's keys carry it, not
+  when a call only asked for it.
 
 ### The closed capability-tag table
 
@@ -188,7 +195,12 @@ Per card and mode the runner writes `docs/qa/platform-checklist/runs/<date>-scen
   (`values`, on `target`) as the same persona through the same MCP door (`POST /api/v1/mcp`, its own API key) and
   reads that answer as the **probe**: the app's validation is measured on every run, whether or not the agent sent
   the bad value, and a careful agent that caught it first is not failed for it. A failed probe is the platform's
-  failure, never the agent's.
+  failure, never the agent's. Every other `refused` create or update is probed the same way, so a permission
+  overstep the agent declined still measures the platform's refusal. An answer that carries no code is reported
+  with whose throw it was (`uncodedNote`: the build's own hook or action, named off the sandbox's wrapper, or the
+  door's text). The runner also records the run dates (each clock instant's UTC and local date) and the fields
+  the agent's own write calls set (`agentSetOf`: a create's or update's `data`, a `run_action`'s `params`); a
+  declared `asOf` value is matched against a run date only in a field the agent did not set.
 - **Namespaces** (`namespace.ts`): every card's app is in the namespace `demo` + the card's `code` (`democrm`): scratch
   mode scaffolds the project under that name, and template mode installs a template declaring it into a host named
   `host<code>` (the unmanaged copy keeps its namespace, and the install refuses one the host owns). The card's names are
 
@@ -65,6 +65,17 @@ export interface LoadedScenario {
   truths: Record<string, Truth>;
   /** Question id → persona id → the truth AS that persona, for questions that list personas. */
   personaTruths: Record<string, Record<string, Truth>>;
+  /**
+   * Question id → persona id → every figure computable from the rows of the
+   * question's object that persona may read, ascending, for questions that
+   * list personas: over its rows in the persona's `scope`, with its fields but
+   * the hidden ones and the fields one lookup away on a row the persona also
+   * sees, the row count, the count of each value of each field, and each
+   * number field's values, sum, mean, least and greatest (none when the
+   * object is hidden). The leak grader flags an all-rows figure only when none
+   * of these equals it (`gradePersonaRun`'s `inScopeFigures`).
+   */
+  scopeFigures: Record<string, Record<string, number[]>>;
 }
 
 export interface LoadResult {
@@ -342,7 +353,7 @@ function checkCard(
   stem: string,
   options: LoadOptions,
   refuse: Refuse,
-): Pick<LoadedScenario, 'truths' | 'personaTruths'> {
+): Pick<LoadedScenario, 'truths' | 'personaTruths' | 'scopeFigures'> {
   const { expect, run } = card;
 
   // ── identity ──
@@ -526,6 +537,43 @@ function checkCard(
   // ── questions: refs resolve, then the truth is computed (and per persona) ──
   const truths: Record<string, Truth> = {};
   const personaTruths: Record<string, Record<string, Truth>> = {};
+  const scopeFigures: Record<string, Record<string, number[]>> = {};
+  /** {@link LoadedScenario.scopeFigures} for one persona over one object. */
+  const figuresInScope = (p: Persona, object: string): number[] => {
+    const hiddenObjects = new Set(p.hidden.objects ?? []);
+    if (hiddenObjects.has(object)) return [];
+    const visible = (o: string) => {
+      const hidden = new Set((p.hidden.fields ?? []).filter((f) => f.object === o).map((f) => f.field));
+      return [...fieldsOf(seed[o])].filter((f) => f !== 'id' && !hidden.has(f));
+    };
+    const mine = (seed[object] ?? []).filter((r) => inScope(p, object, r));
+    const columns: Array<(r: SeedRow) => unknown> = [];
+    for (const f of visible(object)) {
+      columns.push((r) => r[f]);
+      const to = lookupFields.get(`${object}.${f}`);
+      if (to === undefined || hiddenObjects.has(to)) continue;
+      const target = (r: SeedRow): SeedRow | undefined => {
+        const t = typeof r[f] === 'string' ? rowById.get(to)?.get(r[f] as string) : undefined;
+        return t !== undefined && inScope(p, to, t) ? t : undefined;
+      };
+      for (const g of visible(to)) columns.push((r) => target(r)?.[g]);
+    }
+    const figures = new Set<number>([mine.length]);
+    for (const read of columns) {
+      const counts = new Map<unknown, number>();
+      const numbers: number[] = [];
+      for (const r of mine) {
+        const v = read(r) ?? null;
+        counts.set(v, (counts.get(v) ?? 0) + 1);
+        if (typeof v === 'number') numbers.push(v);
+      }
+      for (const n of counts.values()) figures.add(n);
+      if (numbers.length === 0) continue;
+      const sum = numbers.reduce((a, b) => a + b, 0);
+      for (const n of [...numbers, sum, sum / numbers.length, Math.min(...numbers), Math.max(...numbers)]) figures.add(n);
+    }
+    return [...figures].sort((a, b) => a - b);
+  };
   duplicates(run.questions, (q) => q.id, ['run', 'questions'], 'question id', refuse);
   run.questions.forEach((q, i) => {
     const at: IssuePath = ['run', 'questions', i];
@@ -571,9 +619,11 @@ function checkCard(
     if (all) truths[q.id] = all;
     if (q.personas === undefined) return;
     personaTruths[q.id] = {};
+    scopeFigures[q.id] = {};
     q.personas.forEach((id, j) => {
       if (unscoped.has(id)) return;
       const p = run.personas.find((x) => x.id === id)!;
+      scopeFigures[q.id][id] = figuresInScope(p, q.object);
       const hiddenFields = new Set((p.hidden.fields ?? []).map((f) => `${f.object}.${f.field}`));
       const hiddenObjects = new Set(p.hidden.objects ?? []);
       const withheld =
@@ -740,7 +790,7 @@ function checkCard(
   const after = applyExpectDelta(expect, delta);
   checkExpectRefs(delta, new Set(after.objects), new Set(after.dashboards ?? []), at, refuse);
 
-  return { truths, personaTruths };
+  return { truths, personaTruths, scopeFigures };
 }
 
 /** `expect` after an iteration's delta is applied (additive). */